Security

One store, one backend

Every store has its own backend, its own Postgres database and its own Redis cache. Nothing is shared between two stores: not a table, not a row, not a cache. A read that does not find the store it is asking for stops rather than falling back on another one, and that rule is enforced by the code and by a build guard.

The administration of a store is served from its own address, behind its own session.

Card data

Katching never stores and never transmits a card number. The card fields of a store are served by the payment provider inside the page, and the card data goes from your customer to the provider without passing through Katching. The same is true of the card that pays a Katching subscription.

Secrets and keys

The secrets of a store, its payment keys and its administration password, are encrypted at rest with AES-256-GCM. Passwords are stored as hashes, and sessions as hashes of their token: a database dump does not give a password or a usable session.

No secret is written in the source code, printed in a console, or baked into an image layer. A build guard fails the image when one is.

In transit

Every connection is encrypted with TLS, HTTPS everywhere, with HSTS for one year. The platform site is served by Cloudflare, and the backend of a store speaks to its database over the private network of its host.

Access and traceability

Access to the production systems is restricted to the people who operate the service, through their own named accounts. The staff console is behind a separate session and is never opened for a merchant.

Every call to a model is recorded with its price, and every store has a daily ceiling; when it is reached the engines stop calling. Nothing is sent to a model without a trace.

Backups

Katching does not take its own backups of the database of a store today. What exists is what the host provides: the shared database instance is backed up automatically every day, seven backups are kept, and seven days of transaction logs allow a recovery to a point in time. Those backups cover the whole instance and not one store, so Katching cannot restore a single store on demand today. Export what matters to you, and write to hello@katching.ai when you need a copy. When a store is destroyed, its database and its services are deleted at once, and the copy the host's backups still hold disappears with them, within seven days.

Compliance roadmap

Reporting a vulnerability

Write to security at our domain. The address, the scope and the rules are in the disclosure policy.