Security & Trust
What we actually implement — and what we don't claim
NKAMARO is currently in a Founder Closed Alpha. This page describes exactly what security controls exist in the product today, what is actively under development, and which certifications are future targets we have not yet achieved — not marketing language.
Controls in place today
Database-enforced multi-tenant isolation
Every tenant-scoped table uses PostgreSQL Row-Level Security, enforced under a dedicated, non-superuser application role with FORCE ROW LEVEL SECURITY — not application-code filtering alone.
Password hashing
Passwords are hashed with bcrypt at 12 rounds. Raw passwords are never logged or stored.
Short-lived, rotating sessions
Access tokens expire in 15 minutes; refresh tokens rotate on use and can be explicitly revoked. Session tokens are never exposed to browser-side JavaScript — the browser only holds an httpOnly cookie.
Role-based access control
Tenant administrator, manager, employee, and auditor roles are enforced on every request. A separate platform-administrator flag exists only for the operator of the platform and cannot be set through any API.
Human approval on irreversible actions
Irreversible AI Employee actions require a human decision, and permissions are re-checked at the moment of approval — not assumed from when the action was first requested.
Append-only audit log
Every task, approval, permission grant, and revocation is recorded to an audit log with no update or delete path — enforced both in application code and as a database-level privilege restriction.
Rate limiting on sensitive endpoints
Login, password reset, and registration endpoints are rate-limited to reduce credential-stuffing and abuse risk, separate from the platform's general request limits.
Time-limited, hashed verification and reset tokens
Email verification and password reset links use single-use, cryptographically random tokens; only their hash is ever stored, and each expires within hours.
Explicit, recorded consent
Company registration requires explicit, non-pre-checked acceptance of our Terms and Privacy Notice, recorded with a version, timestamp, and the accepting user's identity.
Input validation on every request
Every API request is validated against an explicit schema; unexpected fields are rejected outright rather than silently ignored.
Controls under development
Application performance & anomaly monitoring
Request latency and throughput instrumentation (e.g. OpenTelemetry) is not yet deployed — current operational visibility is limited to error-rate and health-check signals.
Single sign-on (SSO/SAML)
Enterprise identity federation is on our roadmap but not yet available; sign-in is currently email and password only.
Formal third-party penetration testing
We have not yet engaged an external firm for a formal penetration test of the production environment.
Data residency options
Regional data-residency controls beyond a single deployment region are not yet available.
Certifications we do not hold
NKAMARO does not currently hold any of the following. They are targets we may pursue as the platform and its customer base mature, not claims about our present state:
- ISO/IEC 27001
- SOC 2 Type II
- Formal GDPR compliance attestation
- Government or industry-specific regulatory accreditation