Security
How we protect your workspace
A plain account of what Kaltline does today, written from the code. Where something is not in place yet, we say so.
Company data is kept apart
- Every customer, conversation, message, quote and order is stored with the ID of the company it belongs to. Record reads and writes go through one access layer that requires a verified company and filters every query by it.
- A sign-in session belongs to one company membership. Switching company checks that the person is a member of the company they are switching to.
- Automated tests check that one company cannot read or change another company’s records, including through the customer portal.
Passwords are hashed
- Passwords are hashed with scrypt and a random salt for each password, and checked with a constant-time comparison. The password itself is never stored.
- Passwords must be 10 to 256 characters long.
Sessions are short and hard to steal
- A session token is 32 random bytes. Only its SHA-256 hash is stored, so a copy of the database cannot be used to sign in.
- The session cookie is HTTP-only, SameSite=Strict and Secure over HTTPS, and expires after 24 hours.
Provider keys are encrypted
- WhatsApp, SMS, voice and AI provider credentials are encrypted with AES-256-GCM before they are saved. The key is held in the server environment, separately from the database.
- On a hosted database, Kaltline refuses to save provider credentials until that key is set. Call recordings that Kaltline keeps are encrypted the same way.
Logos cannot carry script
- Company logos must be PNG, JPEG or WebP up to 256 KB, checked by their file signature on the server. SVG uploads are refused.
- Logos are served with a Content-Security-Policy of default-src none.
You can take your data with you
- Administrators can export customers, conversations and messages as CSV at any time. Only administrators can export, and each export checks their membership again.
- Staff-only notes are left out of message exports. Cells that a spreadsheet would treat as a formula are written as text.
Hosting
- Application
- Vercel. Server functions run in Singapore (sin1). Traffic is served over HTTPS.
- Database
- Managed PostgreSQL on Neon. Region to be confirmed.
- Current state
- See the status page.
Not in place yet
- Two-step sign-in and single sign-on (SSO) are not available yet.
- Kaltline has no SOC 2 or ISO 27001 certification, and has not yet had an independent penetration test.
- The database region is to be confirmed and will be published here.