Security at Kayan

Your data stays yours

Kayan is multi-tenant: many businesses share the platform, and every record belongs to exactly one organization. Reads and writes are scoped to the signed-in organization, and an automated test suite checks that one organization cannot read another's rows.

Access control

• Role-based permissions, including custom roles, decide who can see and change each area — finance, inventory, payroll and settings are separate permissions.
• Passwords are never stored. Kayan keeps only a salted scrypt hash.
• New accounts confirm their email with a one-time code before they can sign in, and repeated failed sign-ins are counted and throttled.

Encryption

• All traffic is HTTPS-only, with HSTS preload so browsers never fall back to plain HTTP.
• Credentials for the services you connect — store, payment gateway and courier keys — are encrypted at rest with AES-256-GCM before they are saved.

Audit trail

Changes are written to an audit log that records who made the change, when, from which IP address, and the record's values before and after. Ledger lines are append-only at the database level — a correction is posted as a reversal, never an edit — so the books keep their own history.

Application hardening

• A Content Security Policy, frame blocking, MIME-sniffing protection and a strict referrer policy are sent on every response.
• Pages that need an account are checked on the server before anything renders.

Hosting

Kayan's application servers run on Fly.io in Frankfurt, Germany.

Report a security issue

If you believe you've found a vulnerability, email support@foundersbridge.org with the details and steps to reproduce. Please don't access other customers' data or disrupt the service while testing. We'll acknowledge your report and keep you updated while we fix it.