Trust & Security
Your financial information is the most sensitive data you have. Here's exactly how we protect it — no vague promises, just specifics.
Encryption at Rest & in Transit
All data is encrypted using AES-256 encryption at rest. Data in transit is protected with TLS 1.3. Your financial information is never stored in plain text.
Passwordless Authentication
We use magic link authentication — no passwords to steal, no credentials to leak. Each login link expires in 1 hour and works only once.
Partial Data Only
We never ask for or store full account numbers, passwords, or PINs. Only the last 4 digits of identifiers are kept — just enough for your family to identify the account.
Row-Level Security
Every database query is enforced with row-level security policies. Your data is cryptographically isolated — even in the event of a breach, other users' data cannot be accessed through your session.
Hosted on Trusted Infrastructure
KutumbKosh runs on Supabase (PostgreSQL) and Vercel, both SOC 2 Type II certified platforms. Your data resides in secure, managed infrastructure with automated backups.
Audit Logging
Every access to your vault — every login, every data view, every modification — is logged with timestamps and device information. You can review your activity history at any time.
Security Headers
Our application enforces strict Content Security Policy, HSTS, X-Frame-Options, and other HTTP security headers to prevent XSS, clickjacking, and code injection attacks.
Designed with Privacy in Mind
KutumbKosh is designed with India's Digital Personal Data Protection Act (DPDPA) 2023 in mind. We collect only what's necessary, you can delete your data at any time, and formal compliance verification is in progress.
What we store vs. what we don't
Transparency is non-negotiable. Here's the full picture.
Emergency access safeguards
When a trusted contact requests access, here's what happens.
Trusted contacts must be explicitly added and approved by you
They can only request access — you must approve every request
They see asset names and last 4 digits only, never full details
No passwords, PINs, or login credentials are ever shared
Access can be revoked instantly at any time
All access events are logged in your audit trail
Internal access controls
How we protect your data from within.
No team member has routine access to your vault contents
Access to production user data requires explicit founder approval
Every admin database operation is logged with timestamp and reason
The service role key (which bypasses row-level security) is restricted to a single, audited function: account deletion
All admin access events are retained in an audit log for review
Found a vulnerability?
We take security reports seriously. If you've found a security issue, please email us at care@kutumbkosh.com and we'll respond within 24 hours. We appreciate responsible disclosure and will acknowledge your contribution.