Security Policy

1. Organisation

Katari Technologies Ltd assigns responsibility for security to a named owner, reviews this policy at least once a year, and trains staff on it before they receive access.

2. Access control

• Every person has their own account; shared accounts are not allowed.
• Two-step sign-in is required for administrators, finance roles and all platform staff.
• Access follows least privilege and separation of duties: for example, the person who prepares payroll cannot approve it, and a manual payment is confirmed by a second person.
• Platform staff have no standing access to customer data. Support access needs the customer’s approval, is time-limited and is logged in the customer’s audit trail.
• Access is reviewed every quarter and removed promptly when someone leaves.

3. Isolation and integrity

• Each organisation’s data is isolated by row-level security in the database, enforced on every query, in addition to checks in the application.
• Every change is written to a tamper-evident, hash-chained audit trail that customers can verify. The platform operator has its own separate audit trail.
• Application, database and web tiers are separated; the application programming interface is not exposed to the internet directly.

4. Encryption

Data is encrypted in transit with TLS 1.2 or later and at rest by our hosting provider. Secrets such as two-step sign-in keys, bank details and integration tokens are additionally encrypted in the application with AES-256-GCM. Passwords are hashed with Argon2id. Customer backups to Google Drive are encrypted before they leave our servers with a key derived from a passphrase the customer holds.

5. Development and change

Changes are reviewed and pass automated tests, including security and tenant isolation tests, before release. Database changes are applied by versioned, checksummed migrations. Dependencies are monitored and updated for known vulnerabilities.

6. Monitoring and incidents

We monitor availability, errors and unusual activity, keep security logs, and run an incident response process. We notify affected customers of a personal data breach within 72 hours of becoming aware of it, as the Data Processing Agreement sets out.

7. Resilience

The database is backed up continuously with point-in-time recovery and restores are tested every quarter. The recovery targets are in the Service Level Agreement.

8. Payments

Card details are entered only on our payment provider’s hosted page and never reach our servers.

9. Reporting a vulnerability

See the Responsible Disclosure Policy.