Security at Kooshk Tech
We follow shared-responsibility principles: the platform layer (hosting, database, auth, payments) is provided by trusted vendors; application-layer controls are owned by us.
All traffic is served over HTTPS with HSTS. HTTP requests are redirected.
TLS 1.2+ in transit; AES-256 at rest on managed Supabase Postgres.
Email + password with leaked-password protection, plus Google OAuth.
Managed Google sign-in via Lovable Cloud — no third-party app credentials in the codebase.
Every tenant table has RLS policies tied to the authenticated user.
Workspaces enforce data boundaries through both RLS and explicit workspace_id filters.
Private storage buckets, server-side type/size limits, and signed URLs for downloads.
Per-user and per-IP limits on chat, embeddings, and authentication endpoints.
Onboarding events, lead capture, and admin actions are written to an append-only analytics log.
Managed daily database backups with point-in-time recovery on the underlying platform.
Recovery target: restore service within 24 hours and recover data to within 24 hours of incident.
Responsible disclosure
If you believe you have found a security issue, please email security@datakooshktech.tech. We do not pursue researchers acting in good faith.
This page reflects controls currently enabled in the platform. It is not an independent certification.