Security you can actually trust
You run your business (invoices, payments, and client data) on KAZI. Here's an honest, technical look at exactly how we keep all of it safe. No buzzwords, no certifications we don't hold.
How we protect your data
Defense in depth, from the network edge down to individual database rows.
Encryption in transit & at rest
Every byte that moves between your browser and KAZI is encrypted, and your data is encrypted on disk by our managed infrastructure.
- TLS 1.3 for all data in transit
- AES-256 encryption at rest (managed by Supabase)
- HSTS enforced on every response
Row Level Security on Postgres
KAZI runs on Supabase (managed PostgreSQL). Row Level Security policies are enforced at the database layer so a user can only ever read and write their own data, even if application code has a bug.
- RLS policies across user-scoped tables
- Per-request authorization on every API route
- Isolated, dedicated database instance
Strong authentication & MFA
Protect accounts with modern multi-factor authentication, including phishing-resistant passkeys backed by WebAuthn.
- TOTP authenticator-app MFA
- WebAuthn passkeys (biometric / hardware keys)
- Secure session management & sign-out everywhere
Hardened application layer
We completed a full OWASP-aligned security audit and fixed every finding. Those patterns are now mandatory for every route we ship.
- Input sanitization on all public tokens & slugs
- Parameterized queries, no string-concatenated filters
- Per-tier rate limiting (Upstash sliding window)
Payments handled by Paystack
We never see or store raw card numbers. All card payments are processed by Paystack, a PCI-DSS Level 1 certified provider. KAZI is the software; Paystack moves the money.
- PCI-DSS Level 1 processing via Paystack
- No card data stored on KAZI servers
- Card, bank transfer, Apple Pay & Google Pay supported
Read-only bank connections
When you link a bank account, KAZI connects through Plaid, a trusted bank-data aggregator covering the US, Canada, UK and Europe. Access is strictly read-only: KAZI can never move money, and your banking credentials never touch our servers.
- Read-only access: KAZI cannot move or withdraw funds
- Credentials go to your bank via Plaid, never to KAZI
- Access tokens encrypted at rest; disconnect any time to revoke
Backups & reliability
Automated daily backups on managed infrastructure keep your business data protected against worst-case scenarios.
- Automated daily backups
- Point-in-time recovery available
- Redundant, high-availability cloud infrastructure
How we handle secrets & access
Good security is operational, not decorative. These are the day-to-day engineering practices behind every release.
Secrets live in environment variables
No API keys, service-role credentials, or database passwords are committed to source control. Secrets are injected at runtime from a managed secret store and rotated independently of releases.
Audit logging & access control
Role-based access control (RBAC) and granular team permissions govern who can do what. Sensitive actions are recorded in activity and audit logs so teams can see who did what, and when.
Least-privilege by default
Background jobs use scoped service clients, public endpoints select explicit columns only (never SELECT *), and draft or private records are never exposed to unauthenticated visitors.
Privacy & compliance
Honest about where we are on the journey, and where our providers already are.
GDPR & POPIA aligned
We follow GDPR (EU) and POPIA (South Africa) principles: data minimization, lawful processing, and your right to access, export, or delete your data at any time.
Certified infrastructure
KAZI is hosted on Vercel and Supabase, which run on enterprise cloud providers with their own SOC 2 and ISO 27001 certified data centers. Paystack, which processes payments, is PCI-DSS Level 1 and ISO 27001 certified.
You own your data
Your data is yours. Export it in standard formats whenever you want, request full deletion on account closure, and trust that we never sell your data.
Note: KAZI relies on infrastructure providers (Vercel, Supabase) and a PCI-DSS Level 1 payment processor (Paystack) that hold SOC 2 and ISO 27001 certifications. KAZI's own formal certification program is in progress. We're transparent about exactly where we are on that journey and will never claim a certification we don't hold.
Who processes your data
We keep our subprocessor list short and transparent. These are the trusted providers that help run KAZI.
Supabase
Managed PostgreSQL, auth & storage
Vercel
Application hosting & edge network
Paystack
Card payment processing (PCI-DSS L1)
Plaid
Read-only bank data (US, CA, UK, EU), on connect
Upstash
Rate limiting (Redis)
AI providers
Model inference via AI gateway
Wasabi
Durable object storage
Responsible disclosure
Found a security issue? We want to hear from you. We review every report from good-faith researchers, respond quickly, and credit those who help us. A few simple ground rules keep everyone safe:
- Email us before any public disclosure and give us a reasonable window to fix the issue.
- Do not access, modify, or delete data that is not your own; use test accounts where possible.
- No denial-of-service, spam, social engineering, or physical attacks against our staff or infra.
- Stay within scope: kazii.ai and its application surfaces, not our third-party providers.
Security questions, answered
How is my data encrypted?
All traffic to KAZI uses TLS 1.3, and data at rest is encrypted with AES-256 by our managed database provider, Supabase. HSTS is enforced so browsers only ever connect over HTTPS.
Is KAZI SOC 2 or ISO 27001 certified?
KAZI runs on infrastructure providers (Vercel, Supabase) that hold SOC 2 and ISO 27001 certifications, and our payment processing is PCI-DSS Level 1 via Paystack. KAZI is transparent that its own formal certification program is in progress. We will never claim a certification we do not hold.
Where do you store payment card details?
We do not store raw card numbers anywhere on KAZI servers. All card payments are processed directly by Paystack, a PCI-DSS Level 1 certified provider, which supports cards, bank transfer, Apple Pay, and Google Pay.
How do you keep one user from seeing another user’s data?
KAZI enforces Row Level Security (RLS) policies at the PostgreSQL layer, so the database itself rejects any attempt to read or write data that does not belong to the authenticated user, in addition to per-request authorization checks in the application.
Can I export or delete my data?
Yes. You own your data. You can export it in standard formats at any time and request full deletion on account closure. We align our data handling with GDPR and POPIA, and we never sell your data.
How do I report a security vulnerability?
Email security@kazii.ai with details and steps to reproduce. Please give us a reasonable window to remediate before any public disclosure, stay within scope (kazii.ai), and avoid accessing data that is not your own. We respond quickly and credit good-faith researchers.