The short version: encryption at rest, encryption in transit, single-tenant isolation, hourly backups, and an extremely small attack surface. The long version is below.
Kinventory runs on Google Cloud Platform, in US data centers. Web app and API are stateless containers behind Cloud Run; data lives in Firestore and Cloud Storage.
Every record is scoped to an organization and location. Our API enforces scope on every request; cross-tenant access returns 404 (we don't even leak existence).
In transit: TLS 1.3 between every client and our servers. We HSTS-preload inventory.kin.cafe.
At rest: AES-256 by GCP. Customer-managed encryption keys are available on the Custom plan.
End users authenticate via Firebase Authentication (email/password, Google, or Apple). Sessions are issued as short-lived JWTs.
On mobile, Face ID and Touch ID unlock the local session without re-typing a password.
On Custom plans, SAML and OIDC SSO are available, including SCIM for user provisioning.
Firestore snapshots run hourly with 30-day point-in-time recovery. Storage assets (images, receipts) are versioned and replicated to a second region.
Our RTO target is 4 hours; RPO target is 1 hour.
Production data access requires MFA and is granted on a request/approve basis with quarterly recertification. Every access is logged.
Our team can't see image content (receipt photos, item images) without your explicit permission; metadata-only access is sufficient for most support requests.
Sub-processors: Google Cloud Platform, Firebase, Stripe, Square, Twilio (SMS reorders only), Google's Gemini (receipt OCR; images processed and discarded within 24h).
Found a vulnerability? Email security@kin.cafe with details. We respond within one business day, publish a bulletin within 30 days of remediation, and gratefully credit researchers (and pay a modest bounty for impactful findings).
SOC 2 Type II report available under NDA on request. We follow GDPR and CCPA principles for all customers, not just ones in those jurisdictions.
Connect Square, import your catalog, and have your back of house humming by tomorrow's open.