Security & Data Protection
Klority is built for engineering teams that take security, identity, and data privacy seriously. Your code, docs, and test cases are encrypted, logically isolated, and protected by modern security best practices.
01. Infrastructure & Data Isolation
Everything in Klority is built on a resilient, multi-tenant cloud architecture engineered for strict tenant isolation and high availability:
- Hosted on Amazon Web Services (AWS): All compute, storage, and networking run in AWS data centers across multiple Availability Zones (multi-AZ) with automated failover and 99.9% uptime.
- Database Isolation: Workspace data is logically separated at the database layer. Cross-tenant access is strictly prevented by application-level tenant context enforcement on all queries.
- Daily Backups & Disaster Recovery: Automated point-in-time snapshots and daily encrypted backups of all databases and object storage ensure zero data loss.
02. Encryption
All workspace databases, document stores, cached artifacts, and file attachments are encrypted at rest using industry-standard AES-256 encryption.
100% of data transmitted to and from Klority is encrypted using TLS 1.3 (HTTPS-only) with strict HTTP Strict Transport Security (HSTS) headers.
03. Authentication & Access Controls
- ✓ Single Sign-On (SSO): Fast, secure team authentication via Google Workspace, GitHub, or Microsoft Azure AD.
- ✓ Two-Factor Authentication (TOTP MFA): Built-in time-based one-time password (TOTP) MFA for password accounts, compatible with Google Authenticator, 1Password, Bitwarden, and Authy, complete with 8 single-use emergency backup recovery codes.
- ✓ Role-Based & Group Permissions (RBAC/GBAC): Workspace owners can assign roles and organize team members into groups (e.g. Sales, Finance, Engineering) to restrict access to sensitive modules such as CRM, Billing, and Timesheets.
- ✓ Secure Session Management: Domain-scoped, HTTP-only, SameSite cookies with strict session lifetimes prevent session hijacking and CSRF vulnerabilities.
- ✓ API Access Tokens: Granular Personal Access Tokens (PATs) allow secure automated integration with CI/CD pipelines without sharing user passwords.
04. Third-Party Services & Subprocessors
To operate and deliver our services securely, Klority engages a select group of trusted third-party service providers. Each subprocessor is vetted for strict security and data protection standards:
| Service | Role / Purpose | Data Handled | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure, database (RDS PostgreSQL), encrypted object storage (S3), and transactional email (SES) | Application data, attachments, user accounts | USA (Multi-AZ) |
| Paddle / Stripe | Merchant of Record, billing automation, invoicing, and payment processing | Billing details, invoices, payment status (card data stored directly by processor) | UK / USA |
| Microsoft Clarity | Website analytics and session diagnostics to improve application UX | Anonymized usage metrics and interaction telemetry (no workspace data) | USA |
| Google / GitHub / Microsoft | Optional Single Sign-On (SSO) identity authentication | Authentication tokens, user email, profile name | Global |
Data Processing Agreement (DPA)
GDPR & Global Privacy Compliance
We provide a comprehensive Data Processing Agreement (DPA) that satisfies the requirements of the GDPR, UK GDPR, CCPA/CPRA, and relevant data protection regulations worldwide. Our DPA includes standard contractual clauses (SCCs) to govern data transfers and ensure organizational compliance.
Security Inquiries & Vulnerability Reporting
If you believe you have found a security vulnerability or have questions about our security practices, contact us directly at support@klority.com.
Navigation