Security

1. Where the service runs

K-Stra runs on a dedicated server in Sydney, Australia, hosted by OVHcloud in its SYD03 data centre. The application, its database and the files customers upload are on that server; the backups are stored in Sydney too. No copy of the database is kept outside Australia.

2. Accounts and access

• Passwords are stored only as salted one-way hashes (PBKDF2-SHA256).
• Every sign-in with a password also requires a one-time code sent by email; sign-in with Google or Microsoft relies on their own protections.
• Sign-in codes, reset links and invitations are stored only as hashes and expire quickly.
• Successful and refused sign-ins are logged with IP address and browser, and repeated attempts are rate-limited.
• API keys are shown once, stored as hashes, and can be limited by scope, monthly spending and IP address, or revoked at any time.

3. Separation between customers

Every request is checked against the organisation, the team, the membership and the permissions of the person making it. No organisation can read another organisation’s analyses, reports or files. The AI assistant works with the permissions of the user and never queries the database directly.

4. Protection of the application

• All connections use HTTPS, with HSTS.
• A strict content security policy, protection against cross-site request forgery and security headers on every response.
• The internal administration console is separate from the app, with its own sign-in and session.
• A security review of the application was carried out on 13 September 2026.

5. Backups and logs

Databases are backed up to OVHcloud object storage in Sydney, keeping four copies per database. Deleted data disappears from backups as they rotate, in about four months. Server logs never contain passwords, tokens or secrets, mask email addresses, and are rotated.

6. What leaves the server

A few steps use outside providers, listed one by one with what they receive on the sub-processors page. Card payments are handled entirely by Stripe: card details never reach K-Stra.

7. Incidents and reporting a vulnerability

If a breach is likely to cause serious harm, we notify the affected customers without undue delay, and in any case within 72 hours of becoming aware of it, together with the competent authorities where the law requires it. To report a vulnerability or a suspected incident, write to info@k-stra.com; please do not test the service in ways that could affect other customers.