Pro tip: Use ⌘K to quickly search anything in Kazi
Pro tip: Use ⌘K to quickly search anything in Kazi
You run your business (invoices, payments, and client data) on KAZI. Here's an honest, technical look at exactly how we keep all of it safe. No buzzwords, no certifications we don't hold.
Defense in depth, from the network edge down to individual database rows.
Every byte that moves between your browser and KAZI is encrypted, and your data is encrypted on disk by our managed infrastructure.
KAZI runs on Supabase (managed PostgreSQL). Row Level Security policies are enforced at the database layer so a user can only ever read and write their own data, even if application code has a bug.
Protect accounts with modern multi-factor authentication, including phishing-resistant passkeys backed by WebAuthn.
We completed a full OWASP-aligned security audit and fixed every finding. Those patterns are now mandatory for every route we ship.
We never see or store raw card numbers. All card payments are processed by Paystack, a PCI-DSS Level 1 certified provider. KAZI is the software; Paystack moves the money.
When you link a bank account, KAZI connects through regulated aggregators: Plaid (US, Canada, UK, Europe) and Stitch (South Africa). Access is strictly read-only: KAZI can never move money, and your banking credentials never touch our servers.
Automated daily backups on managed infrastructure keep your business data protected against worst-case scenarios.
Good security is operational, not decorative. These are the day-to-day engineering practices behind every release.
No API keys, service-role credentials, or database passwords are committed to source control. Secrets are injected at runtime from a managed secret store and rotated independently of releases.
Role-based access control (RBAC) and granular team permissions govern who can do what. Sensitive actions are recorded in activity and audit logs so teams can see who did what, and when.
Background jobs use scoped service clients, public endpoints select explicit columns only (never SELECT *), and draft or private records are never exposed to unauthenticated visitors.
Honest about where we are on the journey, and where our providers already are.
We follow GDPR (EU) and POPIA (South Africa) principles: data minimization, lawful processing, and your right to access, export, or delete your data at any time.
KAZI is hosted on Vercel and Supabase, which run on enterprise cloud providers with their own SOC 2 and ISO 27001 certified data centers. Paystack, which processes payments, is PCI-DSS Level 1 and ISO 27001 certified.
Your data is yours. Export it in standard formats whenever you want, request full deletion on account closure, and trust that we never sell your data.
Note: KAZI relies on infrastructure providers (Vercel, Supabase) and a PCI-DSS Level 1 payment processor (Paystack) that hold SOC 2 and ISO 27001 certifications. KAZI's own formal certification program is in progress. We're transparent about exactly where we are on that journey and will never claim a certification we don't hold.
We keep our subprocessor list short and transparent. These are the trusted providers that help run KAZI.
Managed PostgreSQL, auth & storage
Application hosting & edge network
Card payment processing (PCI-DSS L1)
Read-only bank data (US, CA, UK, EU), on connect
Read-only bank data (South Africa), on connect
Rate limiting (Redis)
Model inference via AI gateway
Durable object storage
Found a security issue? We want to hear from you. We review every report from good-faith researchers, respond quickly, and credit those who help us. A few simple ground rules keep everyone safe:
All traffic to KAZI uses TLS 1.3, and data at rest is encrypted with AES-256 by our managed database provider, Supabase. HSTS is enforced so browsers only ever connect over HTTPS.
KAZI runs on infrastructure providers (Vercel, Supabase) that hold SOC 2 and ISO 27001 certifications, and our payment processing is PCI-DSS Level 1 via Paystack. KAZI is transparent that its own formal certification program is in progress. We will never claim a certification we do not hold.
We do not store raw card numbers anywhere on KAZI servers. All card payments are processed directly by Paystack, a PCI-DSS Level 1 certified provider, which supports cards, bank transfer, Apple Pay, and Google Pay.
KAZI enforces Row Level Security (RLS) policies at the PostgreSQL layer, so the database itself rejects any attempt to read or write data that does not belong to the authenticated user, in addition to per-request authorization checks in the application.
Yes. You own your data. You can export it in standard formats at any time and request full deletion on account closure. We align our data handling with GDPR and POPIA, and we never sell your data.
Email security@kazii.ai with details and steps to reproduce. Please give us a reasonable window to remediate before any public disclosure, stay within scope (kazii.ai), and avoid accessing data that is not your own. We respond quickly and credit good-faith researchers.