Security at Kainen
Last updated: November 14, 2026 · Version française
In short
- Your data is hosted in Toronto (Canada) at DigitalOcean.
- Encrypted connections, hashed passwords, an access check every time a map is opened.
- Nightly backups are planned before the official launch; meanwhile, export your maps.
- No third-party script, no advertising, no outside analytics tool in the app.
How your data is protected
Hosting
- Servers, database (PostgreSQL), backups and logs at DigitalOcean, in Toronto. DigitalOcean holds SOC 2 Type II and ISO 27001 attestations.
- Every connection uses HTTPS (TLS); browsers are told to always use HTTPS (HSTS).
Accounts and sign-in
- Passwords of at least 12 characters; passwords known to have leaked are refused; repeated attempts slow down.
- Passwords stored only as a hash (Argon2id), never in plain text.
- Your email is confirmed before anyone can find you to share with you.
- Random 256-bit session tokens, stored hashed; a cookie scripts cannot read (
HttpOnly,Secure,SameSite). - A session ends after 14 days unused; "Sign out everywhere" on the Account page.
Access to maps
- Every request and every live connection checks your rights on the map or board.
- New maps are private by default. Sharing defaults to view only, and view links expire after 30 days.
- Share links are stored hashed and allow reading only.
- Only the owner sees members' emails. A member can leave a map.
Logs
- A security log records sign-ins, access changes and map openings (who, what, when, IP address) so an incident can be investigated. IP addresses are erased from it after 12 months.
- Server logs keep a shortened IP address and hide share tokens.
Code
- Parameterised database queries; every input is validated and size-limited.
- Exports (CSV, HTML review copy) neutralise formulas and code.
- Per-account limits on new maps, boards and imports protect the service.
- A weekly check of software dependencies; pinned versions.
- A code security review and attack tests on 2026-11-13, against OWASP ASVS 4.0 level 2; the problems found are fixed before going online.
Backups
- During early access, automatic backups are not yet active: export your important maps regularly (
.kainen.jsonfile). - Before the official launch: a full copy every night, kept 30 days in private storage in Toronto, and a real restore tested.
Administration
- Only the founder has administrator access.
- Secrets (keys, passwords) are kept in the host's console, never in the code.
- Updates are deployed after automated tests.
In your browser
- An offline copy of your maps stays on your device; copies tied to your account are cleared when you sign out.
- On a shared computer, sign out when you leave.
Our providers (subprocessors)
| Provider | Role | Data received | Location |
|---|---|---|---|
| DigitalOcean | Hosting: servers, database, backups, logs | All service data | Toronto, Canada |
| Cloudflare | Domain names (DNS); hosting of the kainen.io showcase site; forwarding of [email protected] (once that forwarding is switched on) | Site visitors' IP addresses and requests; email sent to support | Global network, including outside Canada |
| Stripe | Payments (only once paid plans are offered) | Account email, Kainen id, plan, seats. Stripe itself collects the card and billing address | United States |
| Resend | Service email (confirmation, password, invitations) from mail.kainen.io, once that feature is switched on | Email address, name, message content | United States |
| Have I Been Pwned (Pwned Passwords) | Check that a password has not already leaked | Only the first 5 characters of the password's hash | Public online service, outside Quebec |
We add a provider to this list on the day it is switched on, before it receives any data (for example sign-in with Google or Microsoft, or an artificial intelligence provider). The full list of data and retention periods is in the privacy policy.
Report a vulnerability
Think you found a security problem? Write to [email protected] with the subject "Security". Describe the problem and how to reproduce it.
- We acknowledge within 5 business days and keep you informed of the fix.
- Test only with your own accounts and maps. Do not access, change or keep other people's data beyond what is needed to show the problem.
- No denial of service, phishing, social engineering or spam.
- Give us reasonable time (90 days) before publishing anything.
- If you follow these rules in good faith, we will not take action against you.
- There is no reward programme for now; we will thank you publicly if you wish.
Incidents
A confidentiality incident is handled under our governance policy, and you are told as set out in the privacy policy.