Kindly’s web application is built with security at its core, enabling customers to control access, protect data, and detect misuse. Security controls are embedded into the application architecture and continuously improved.
Our web application security includes:
Role-Based Access Control (RBAC): Fine-grained access control at organization and workspace level, supporting both predefined and custom roles.
Single Sign-On (SSO): SSO integration with identity providers like Microsoft Entra ID and Google to centralize and secure authentication.
Multi-Factor Authentication (MFA): MFA support is available for all customer users via OTP otr SSO.
Strong password policy: Passwords must meet strict complexity requirements. No default or temporary passwords are used.
Brute-force protection: Login attempts are rate-limited.
Automatic data masking: Sensitive data (e.g. emails, SSNs) can be automatically anonymized or masked using configurable filters.
Audit logs: All critical actions are logged with user ID, timestamp, action type, and affected objects. Audit logs are immutable and searchable.
Session security: Sessions are managed securely with appropriate expiration, token rotation, and protection against session hijacking.
Role-Based Access Control (RBAC): Fine-grained access control at organization and workspace level, supporting both predefined and custom roles.
Single Sign-On (SSO): SSO integration with identity providers like Microsoft Entra ID and Google to centralize and secure authentication.
Multi-Factor Authentication (MFA): MFA support is available for all customer users via OTP otr SSO.
Strong password policy: Passwords must meet strict complexity requirements. No default or temporary passwords are used.
Brute-force protection: Login attempts are rate-limited.
Automatic data masking: Sensitive data (e.g. emails, SSNs) can be automatically anonymized or masked using configurable filters.
Audit logs: All critical actions are logged with user ID, timestamp, action type, and affected objects. Audit logs are immutable and searchable.
Session security: Sessions are managed securely with appropriate expiration, token rotation, and protection against session hijacking.
Technical Security
Kindly’s infrastructure is designed for resilience, scalability, and security. We apply a layered approach to protect our systems and your data at every level — in line with ISO 27001 requirements and cloud security best practices. The data is securely stored in EU data centers.
Our infrastructure security includes:
Data encryption in transit and at rest: All data is encrypted using industry standards (TLS 1.2+ for data in transit, AES-256 for data at rest).
Secure password storage: Passwords are hashed using PBKDF2 + HMAC-SHA256 with unique salts.
System hardening: Components are hardened based on security benchmarks.
Logging and monitoring: Infrastructure events are logged and monitored continuously.
Threat detection: Services are run to help detect anomalies and threats in real time.
Role-Based Access Control (RBAC): Access to infrastructure components is tightly controlled, role-scoped, and reviewed regularly.
Backups: Point-in-time recovery backups are maintained with automatic integrity checks and encrypted storage.
DDoS protection: Protection against volumetric and application-layer attacks.
Redundant architecture: Services are deployed across multiple data centers with failover mechanisms in place.
Autoscaling: Core services scale automatically to maintain performance and availability under load.
Audit logging: All infrastructure access and changes are logged and stored securely for traceability and compliance.
Patch management: Systems are regularly updated with critical security patches and monitored for vulnerabilities.
Secrets management: Sensitive credentials and tokens are stored securely using managed secret stores with strict access controls.
Vulnerability scanning: Automated scans are regularly performed to identify known security issues across systems and dependencies.
Penetration testing: Independent penetration tests are conducted on a regular basis to uncover and address potential vulnerabilities.
Data encryption in transit and at rest: All data is encrypted using industry standards (TLS 1.2+ for data in transit, AES-256 for data at rest).
Secure password storage: Passwords are hashed using PBKDF2 + HMAC-SHA256 with unique salts.
System hardening: Components are hardened based on security benchmarks.
Logging and monitoring: Infrastructure events are logged and monitored continuously.
Threat detection: Services are run to help detect anomalies and threats in real time.
Role-Based Access Control (RBAC): Access to infrastructure components is tightly controlled, role-scoped, and reviewed regularly.
Backups: Point-in-time recovery backups are maintained with automatic integrity checks and encrypted storage.
DDoS protection: Protection against volumetric and application-layer attacks.
Redundant architecture: Services are deployed across multiple data centers with failover mechanisms in place.
