KaydSecurity
A plain description of the security controls actually in place, and how to report a vulnerability responsibly.
1. Platform security controls
This list describes controls that are actually implemented today, verified directly — not a generic security-page template:
- HTTPS everywhere, with HTTP Strict Transport Security (HSTS) forcing encrypted connections.
- Role-based access control — staff accounts only see and do what their assigned role permits.
- Tenant separation — each business's data is isolated from every other business at the application and query level.
- Password hashing — passwords are never stored in plain text; they're hashed with bcrypt.
- Login rate limiting — repeated failed login attempts from the same source are throttled.
- Debug mode disabled in production — error pages shown to visitors never expose stack traces, file paths, or internal configuration.
- Backups — the production database is backed up periodically and stored outside the public web directory.
- Logging — application errors and key security events are logged for troubleshooting and incident review.
- Ongoing updates — the platform and its dependencies are updated as part of regular maintenance.
We do not claim ISO 27001, SOC 2, PCI DSS, or any other formal certification — none currently exists for KaydPOS. We also don't promise perfect security or a guarantee against every possible incident; no honest description of any system can promise that.
2. Your responsibilities
- Keep staff login credentials confidential and unique to each staff member.
- Assign roles/permissions appropriate to each staff member's actual job.
- Disable accounts promptly for staff who leave.
- Report anything that looks like unauthorised access to your account immediately.
3. Responsible disclosure
If you believe you've found a security vulnerability in KaydPOS, please report it to security@kaydpos.com with:
- A clear description of the issue and its potential impact
- Steps to reproduce it
- Any relevant screenshots, requests, or proof-of-concept detail (without including another customer's real data)
Please do not
- Access, modify, or delete data belonging to another business
- Run destructive tests (for example, tests that could disrupt service for real customers)
- Publicly disclose a vulnerability before we've had a reasonable opportunity to address it
We aim to acknowledge reports within a reasonable timeframe and will work with you in good faith on coordinated disclosure. We do not currently run a formal paid bug-bounty programme.