Trust

Security

Kepto is built for teams that need to know who has what — and prove it later. This page summarizes how we protect accounts, isolate organizations, and keep handoff history accountable.

Last updated: September 1, 2026

Tenant isolation

Append-only handoffs

2FA & session control

Role-based access

TLS + hashed secrets

Exportable audit trail

Current assurance scope

Kepto is an operations product for physical asset handoffs (keys, badges, equipment, vehicles, and similar items). The practices below describe how the product is designed today. Kepto does not currently claim FedRAMP, SOC 2, ISO 27001, or another third-party security certification. Completed assurances will be published here as they become available.

Access control

People only see what their role and organization allow.

·Multi-tenant isolation by organization: queries are scoped so one workspace cannot read another’s assets or history.
·Role-based access: regular users, admins, and platform superusers with different privileges.
·Sensitive actions (billing, invites, import/export, member creation) require a verified email address.
·Optional TOTP two-factor authentication with one-time recovery codes and protected secret storage.
·Google sign-in is optional. Existing password accounts are never silently linked — linking requires a signed-in user whose email matches Google.

Authentication & sessions

Sessions are short-lived, revocable, and protected against common account attacks.

·Passwords are hashed with bcrypt (cost factor 12). Kepto does not store plaintext passwords.
·Sessions use HTTP-only cookies with signed JWTs. Default lifetime is 24 hours (configurable).
·Password changes, role changes, and email changes bump a session version so older sessions stop working immediately.
·HTML navigations re-check session validity so revoked cookies cannot keep browsing the app shell.
·Login, registration, password reset, and 2FA challenges are rate-limited; auth limits fail closed if the limiter is unavailable.

Audit integrity

Handoff records are built to be attributable and hard to rewrite.

·Issue and return history is append-only. Editing or deleting handoff rows is disabled at the API.
·Permanent asset deletion is disabled so operational history is preserved; assets are archived instead.
·Organization audit logs capture important account and configuration events for admins on eligible plans.
·Pro and higher plans can generate audit packets and export history for reviews and investigations.
·Public borrower receipt links use unguessable tokens, store only a hash at rest, expire, and revoke on return.

Data protection

Data is encrypted in transit; sensitive tokens and media are handled carefully.

·All traffic is served over HTTPS/TLS in production.
·Password-reset, email-verification, invite, and email-change tokens are stored as SHA-256 hashes, not plaintext.
·Asset photos and profile avatars default to private object storage and are streamed only through authenticated API routes.
·Billing card numbers are handled by Stripe; Kepto does not store full card data.
·Customer-entered asset and holder data is processed on behalf of your organization (see Privacy Policy).

Architecture & subprocessors

Kepto runs on managed cloud infrastructure with a public vendor list.

·Application hosting: Vercel (Next.js). Database: Neon Postgres. Email: Resend. Payments: Stripe. Optional OAuth: Google. Errors: Sentry when configured. Photos: Vercel Blob.
·A public subprocessor list is maintained for privacy and vendor reviews.
·Database region depends on your deployment configuration. Contact us if you need a specific residency discussion for enterprise.
·Content Security Policy uses per-request nonces for scripts (no production script-src unsafe-inline).
·Production health checks and structured audit events support operational monitoring.

Operations & responsible disclosure

How to request data, report issues, and run a security review.

·Export available asset and history data from the product on eligible plans; contact support for organization-level export or deletion requests.
·For security reviews, questionnaires, or DPA discussions, email support@kepto.io or use the contact form with subject “Security review”.
·To report a vulnerability, email support@kepto.io with “Security vulnerability” in the subject. Please allow reasonable time before public disclosure.
·We do not currently claim SOC 2, ISO 27001, FedRAMP, or similar certifications. We will update this page if that changes.
·No internet service can guarantee absolute security. We apply safeguards appropriate to the product’s risk profile and continue to harden based on review.

Security questionnaire or enterprise review?

Share your checklist and we will map it to architecture notes, subprocessors, and this overview. For privacy or DPA language, start with our Privacy Policy and Subprocessors.

Request a security review or email support@kepto.io

Current assurance scope