Trust & Security

Kontracks operates a multi-tenant SaaS platform that handles regulated communications, financial data, and customer relationships for home-improvement service businesses. Security is a foundational engineering requirement, not a feature. The information below describes the controls in place today and what we commit to going forward.

1. Infrastructure

The Kontracks production environment is built on hyperscaler infrastructure operated by SOC 2 Type II–certified providers:

• Hosting and compute. Vercel (web application, API, edge network, cron execution). Vercel maintains SOC 2 Type II.
• Database. Neon-managed PostgreSQL with point-in-time recovery, encryption at rest, and replicas across availability zones. Neon maintains SOC 2 Type II.
• Object storage. Google Cloud Storage for photos, attachments, and generated documents. GCS encryption at rest and access logging are enabled.
• Edge protection. Vercel edge WAF plus rate limiting and bot protection on public routes.

2. Application security

• Multi-tenant isolation. Every record carries an explicit tenant identifier. Every database query is scoped to the requesting tenant at the application layer; cross-tenant access requires elevated operator authorization and is logged. Background jobs are tenant-scoped by construction.
• Authentication. Password hashing with bcrypt (cost factor 12); session tokens scoped per tenant; signed-out session invalidation; rate-limited login attempts; passwordless email magic-link option; SSO available for enterprise plans.
• Authorization. Role-based access control with the principle of least privilege. Sensitive actions (financial-record edits, invoice voiding, mass-delete, third-party integration management) require elevated permissions and are logged.
• OAuth tokens. Tokens for Stripe, QuickBooks Online, Gmail, Microsoft 365, AI providers, and other Third-Party Services are encrypted at the column level using AES-256-GCM before being written to the database. Encryption keys are managed at the platform layer and rotatable independently of application secrets.
• Audit logging. Authentication events, administrative actions, financial-record changes, integration connect/disconnect, and access to sensitive integrations are logged with user attribution and timestamp. Logs are retained for at least one year.
• Input handling. Parameterized database queries throughout (Prisma ORM). HTML output is escaped by default in the React UI. PDF and DOCX generation runs in a sandboxed worker. File uploads are scanned against an allowlist of MIME types and size limits, stored at random object paths, and never executable.
• Webhook verification. Inbound webhooks from Stripe, QuickBooks Online, Telnyx, and email providers are signature-verified before any action is taken.
• Idempotency. Financial writes use externalEventId-based idempotency keys to prevent double-recording in the event of a retried webhook or network blip.

3. Cryptography

• TLS 1.2 or higher on all client-server and sub-processor connections.
• AES-256 encryption at rest for the database and backups.
• AES-256-GCM column-level encryption for OAuth tokens, refresh tokens, Third-Party Service API keys, and other sensitive credentials, using the same proven scheme across email tokens, Google OAuth tokens, AI provider keys, and QuickBooks tokens.
• HMAC-SHA256 signing of state parameters in OAuth flows (with a 15-minute TTL) to prevent CSRF and replay attacks.
• bcrypt with cost factor 12 for password hashing.

4. People & access

• All personnel sign written confidentiality and acceptable-use agreements as a condition of employment or contract.
• Background checks are performed for personnel with production access, where lawful.
• Annual security awareness training, plus role-specific training for engineers (secure coding) and support (social-engineering awareness).
• Production access is granted to a small named team, requires multi-factor authentication, is logged, and is reviewed at least quarterly.
• Production access is revoked within one business day of role change or departure.

5. Software development lifecycle

• All changes go through version control (git), with mandatory peer review before merging to the protected main branch.
• Continuous integration runs the full test suite, type checker, and dependency vulnerability scan on every commit.
• Deployments are automated, reproducible from source, and rollback-able within minutes.
• Feature flags allow risky changes to be rolled out gradually and reverted instantly without redeploy.
• Migrations are tested against shadow data and applied to production behind a maintenance lock.

6. Vulnerability management

• Automated dependency scanning on every commit; critical vulnerabilities are patched within seven (7) days; high vulnerabilities within thirty (30) days.
• Annual third-party penetration testing of the production environment. Findings are tracked to closure on a documented timeline based on severity.
• Coordinated vulnerability disclosure program — see Section 9.

7. Business continuity & disaster recovery

• Database backups every fifteen (15) minutes (point-in-time recovery window of 7 days; longer windows available on enterprise plans).
• Geographic redundancy across at least two availability zones for the primary database.
• Object storage redundancy: GCS multi-region buckets with versioning and lifecycle rules.
• Recovery objectives: RPO ≤ 1 hour, RTO ≤ 4 hours for Tier-1 systems (login, invoice operations, integration sync).
• Annual disaster-recovery exercise validating the runbook.

8. Incident response & breach notification

• Documented incident response runbook covering detection, classification, containment, eradication, recovery, and post-incident review.
• On-call rotation 24×7 for severity-1 incidents.
• Tabletop exercises performed at least annually.
• Customer notification of confirmed Personal Data Breaches within 72 hours of confirmation, per Section 10 of the DPA.
• Post-incident report shared with affected Customers within thirty (30) days of resolution, where the incident has Customer impact.

9. Vulnerability disclosure

If you believe you have discovered a vulnerability in the Kontracks platform, please report it to security@kontracks.com with as much detail as possible. We acknowledge reports within two (2) business days and aim to remediate confirmed vulnerabilities on the timelines above.

Safe harbor. We will not pursue legal action against a researcher who acts in good faith and within the following limits: (a) does not access or modify data belonging to other Customers; (b) does not perform denial-of-service testing, social engineering, or physical attacks; (c) provides a reasonable opportunity to remediate before public disclosure; and (d) complies with all applicable laws.

We do not currently operate a paid bug bounty, but credit you publicly with permission. Significant impactful reports may be eligible for swag and discretionary acknowledgement.

10. Compliance & assurance

• Sub-processors: Vercel, Neon, Google Cloud, Stripe, Intuit, and Telnyx each maintain SOC 2 Type II reports. We rely on these reports as compensating controls for the underlying infrastructure.
• PCI-DSS: Card data is processed exclusively by Stripe; Kontracks does not store full card numbers and is therefore eligible for SAQ-A (the lowest PCI complexity).
• GDPR / UK GDPR / Swiss FADP: The DPA incorporates the EU Standard Contractual Clauses for restricted transfers.
• CCPA / CPRA, VCDPA, CPA, CTDPA, UCPA, TDPSA: See the California Privacy Notice and Privacy Policy.
• TCPA / CAN-SPAM / CASL / 10DLC: See the SMS AUP and SMS Consent Disclosure.

Customers under NDA may request our security questionnaire responses and the SOC 2 Type II reports of our hosting providers by emailing security@kontracks.com.

11. Customer responsibilities

Security is a shared responsibility. Customers are responsible for:

• Selecting strong, unique passwords and enabling multi-factor authentication;
• Deprovisioning Authorized Users promptly when they leave or change roles;
• Reviewing the integrations connected to their tenant (Stripe, QuickBooks Online, Gmail/Microsoft, AI providers) and disconnecting any that are no longer needed;
• Not uploading prohibited content (Section 1 of the AUP) — including unredacted PCI, full Social Security Numbers, or HIPAA-regulated PHI absent a Business Associate Agreement.

12. Contact

Security: security@kontracks.com
Vulnerability disclosure: security@kontracks.com
Privacy: privacy@kontracks.com
Mailing address: LWR Technologies, Inc. · 390 NE 191st St STE 32488 · Miami, FL 33179 · United States.