Your books are yours, and kept separate
Accounting data is sensitive. This page says plainly how Kanakku Cloud protects it, where it lives, what you can take with you, and what we do not claim.
How we protect it
A private database for every company
Each workspace has its own database. Your records are never stored in the same database as another company's.
Encrypted connections
Traffic to the app is served over HTTPS, and the app connects to its databases over TLS.
Passwords stored hashed
Passwords are hashed with bcrypt, never stored in readable form. Sign-in and password-reset attempts are rate limited.
Two-factor sign-in
Turn on an authenticator app for your account. Roles and permissions control who can see and change what.
An activity log
See who did what and when across invoices, the ledger and settings.
Stored keys are encrypted
Payment gateway keys, email passwords and AI provider keys are encrypted with AES-256-GCM before they are stored.
Signed payment webhooks
Stripe and Razorpay notifications are only accepted when their signature verifies against your own webhook secret.
Hardened by default
The server sends standard security headers, including HSTS, and refuses to start with a weak or placeholder signing secret.
Bring your own AI key
AI bill reading uses the Claude or OpenAI key you supply, with per-user limits, and you review before anything is posted.
Your data
- You own the data in your workspace. We use it only to run the service for you, as set out in the Privacy Policy.
- Export your records as CSV files: invoices and their items, customers, quotations, credit notes, delivery challans, journal entries and the chart of accounts.
- Card payments for your subscription are taken by Stripe. We do not store your card details.
If you close your company
- Access stops as soon as the closure is scheduled.
- Your data is then held for a retention period, 30 days by default, so an accidental closure can be reversed.
- Deletion of a company database is a deliberate, separate step. It needs the retention period to have passed, an export to exist, and a person to confirm it.
Where it runs
- Microsoft Azure hosts the service and its PostgreSQL databases.
- Cloudflare sits in front of the site for network protection.
- Stripe processes subscription payments.
What we do not claim
- We do not hold a SOC 2 or ISO 27001 certification.
- We do not publish an uptime guarantee for the Free and Pro plans. Enterprise agreements can include one.
- Security and legal terms are in our Terms and Privacy Policy; read them for the full picture.
Found a security problem?
Please tell us privately at [email protected] with enough detail to reproduce it. We will acknowledge it and look into it. Please give us a reasonable time to fix a problem before you share it publicly. Our contact details are also in security.txt.