Security profile.
Every control Kontrol runs, with its real parameters, and the limits we have not closed yet. Written for the person who has to sign off on it.
- PIN hashing
- scrypt N=16384
- Roles / permissions
- 9 / 51
- Framing
- Denied everywhere
- Disclosure
- hello@kyledev.site
What is enforced, and how hard.
Authentication
Accounts sign in by emailed magic link and must verify their address before the back office opens.
- Primary credential
- Email magic link, session cookie
- Unverified email
- Redirected to verification; no workspace access
- Sign-in rate limit
- 10 requests / min per IP
Till PINs
A PIN unlocks a till that already has a signed-in session. It is never the only credential.
- Algorithm
- scrypt, N=16384, r=8, p=1
- Salt
- 16 random bytes per credential
- Comparison
- Constant time
- Length
- 4 to 6 digits
- Unlock limit
- 5 attempts / min per user; floods raise an alert
Authorisation
Permissions are checked on the server for every API request, not only hidden in the interface.
- Roles
- 8: owner, administrator, manager, cashier, stock controller, purchasing, accountant, marketing
- Permissions
- 51 distinct grants
- Deploy Satellite POS
- Owner and administrator only
Tenancy
Each business's data is fenced off by its organisation id on every row.
- Scoping
- Every query filters by the active organisation
- Multi-business users
- Switch organisations explicitly; context follows the switch
Rate limits
Write-heavy and abuse-prone routes are throttled per session or per IP.
- Sales
- 60 / min per session
- Refunds
- 10 / min per session
- Products, customers
- 30 / min per session
- Contact form
- 3 per 10 min per IP
- Public version API
- 30 / min per client
Browser hardening
Every response carries a strict set of security headers.
- Content-Security-Policy
- default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'
- Framing
- X-Frame-Options DENY
- Sniffing
- X-Content-Type-Options nosniff
- Referrer
- strict-origin-when-cross-origin
- Permissions-Policy
- camera, microphone, geolocation and payment disabled
Security logging
Security events are written as single-line JSON so they can be filtered and alerted on.
- Events
- Auth attempts, permission denials, rate limits, org switches, sales, refunds, security alerts
- Redaction
- Tokens, cookies, passwords, secrets, sessions and request bodies are never logged
Verify what you install.
Checksums are published in SHA256SUMS.txt alongside every release.
Check on Windows
certutil -hashfile <file> SHA256What we have not closed yet.
Stated plainly so you can plan around them.
- Offline queue
- Sales taken offline are held in the till's local storage until they sync. They are not encrypted at rest; keep till PCs physically secure.
- Installer signing
- The Windows installer is not code-signed yet, so SmartScreen warns on first run. Verify the SHA-256 checksum before installing.
- Rate-limit scope
- Limits are held in memory per server instance. They are exact on a single server and approximate across several.
- Browser tills
- A browser till needs a live connection; only the Windows till sells offline.
Found a vulnerability? Tell us first.
Email the details and steps to reproduce. We reply within one business day, South African time, and keep you updated until it is fixed. Please do not test against other businesses' data.