Kanbrio Security

Version 1.0 · Effective 29 September 2026

Published at: https://kanbrio.com/securityProvider: [to be confirmed] (ABN [to be confirmed]), trading as Kanbrio, of [to be confirmed]Contacts: [email protected] (security reports) · [email protected] (data protection)

This page summarises how Kanbrio protects your data and how to report a security issue. The full list of measures, each marked "in place" or "being implemented", is Annex II of our Data Processing Agreement (https://kanbrio.com/dpa). If this page and the DPA differ, the DPA applies.

1. Each organisation's data is kept apart

Every database table that holds customer data has PostgreSQL row-level security switched on and enforced. The application connects to the database with an account that cannot bypass it. Each request is tied to one organisation, and if no organisation is set, the database returns no rows rather than all rows. Automated tests that run on every code change check that one organisation cannot read or write another's data.

2. A hash-chained audit log

Every change made through the API passes through a single path that checks permissions and writes an audit record. Audit records are hash-chained per organisation: each record carries a fingerprint of the one before it. The application can add records but cannot change or delete them, and free text is removed from a record before it is stored. A write-once copy of the audit log and signed daily checkpoints are being implemented; meanwhile the hash chain is included in every nightly backup.

3. Where your data is stored

Your data is stored on servers Kanbrio operates in Australia, and our backups are kept in Australia. The coding executor runs on a server in Sydney, Australia. "Stored in Australia" is about storage: traffic passes through Cloudflare's worldwide network, which terminates the encrypted connection at the location nearest to you, and some providers process data elsewhere, for example email through SendGrid and AI through Anthropic in the United States. The full list, with what each provider receives, is at https://kanbrio.com/subprocessors.

4. Sign-in and access

4.1 People sign in through Kanbrio's own sign-in service (Keycloak, OpenID Connect). Passwords must be at least 12 characters and cannot reuse the last 3, and repeated failed sign-ins trigger brute-force protection. Multi-factor sign-in (an authenticator app or a passkey) for every user is being implemented with our sign-in service upgrade.

4.2 Every API call is checked against the caller's organisation membership and role (owner, admin, member, guest or agent). Destructive actions requested by agents wait for a person to approve them. Agent API keys stored only in hashed form are being implemented; meanwhile each agent has its own separate credential that your organisation can revoke.

4.3 Administrative access to the production systems is limited to Kanbrio's founder. [to be confirmed]

5. Encryption and network

Connections to Kanbrio are encrypted with TLS. Traffic travels from Cloudflare to our servers through an encrypted tunnel that our servers open outwards, so the servers accept no direct inbound connections from the internet. AI provider keys you give us are encrypted in the database and only their last four characters are shown.

6. Backups

Full backups of the application database, the sign-in database, attachment files and the audit log are taken nightly to a separate storage device on our private network. At least 14 daily and 8 weekly backup sets are kept, each with a checksum manifest, and a written restore procedure exists. Annex II item 3 of the DPA states how backups are encrypted. A second, off-site backup copy is being implemented; meanwhile backups are on a separate device at the same site as the production server.

7. Availability

Kanbrio's availability is best-effort, from a single site: the service runs on a small number of servers at one location in Australia, with a daily maintenance window of about 5 minutes at 19:00 UTC, and support during business hours in Australian Eastern Standard Time. We do not offer a service level agreement (Terms clause 4.3). Keep your own copies of anything critical.

8. Reporting a security issue

Email [email protected]. Our security contact details are also published at https://kanbrio.com/.well-known/security.txt. Good-faith security research that follows section 13 of our Acceptable Use Policy (https://kanbrio.com/aup) is welcome. Please give us a reasonable time to fix an issue before you disclose it.

If we become aware of a personal data breach affecting your organisation's data, we tell you without undue delay and within 72 hours (DPA section 12).

Change log