Kioku legal

Security Overview

Last updated: July 16, 2026

This is a factual, high-level description of current Kioku practices. It creates no contractual commitment, warranty, guarantee, certification, audit representation, or service level.

Important notice

This page is provided for general information and does not constitute legal advice. It has not been reviewed by counsel.

1. Managed architecture

Vercel hosts the application and provides CDN and edge services.
Neon provides managed PostgreSQL used through Vercel.
Clerk provides production identity and authentication.
Vercel Blob stores photos and files in a private store.

2. Tenant and access controls

Account-owned database rows carry an internal tenant identifier. Server-side authorization helpers scope application access. Private image routes check account authorization before delivering files. Service credentials are used on the server and are not intentionally exposed to browsers.

3. Data practices

Google Analytics runs on our public marketing and legal pages only. It is not loaded on any signed-in page, so no analytics event carries a client record or a client identifier.

Kioku has no AI feature and sends nothing you store to any model. See the Privacy Policy.

Client photos are held in private storage and served only through authenticated routes that check account ownership on every request. Photo files are not published at guessable URLs.

Mailbox polling requires a server-only cron secret, and messages are deduplicated by internet message ID. Public unsubscribe links and tokenized reply addresses use signed opaque tokens rather than raw database IDs. Inbound HTML is reduced to safe inert content, remote content is not loaded in the signed-in inbox, and attachment files are not downloaded in this version.

4. Deletion, availability, and recovery

Kioku uses archive and soft-delete fields for several records. Hard deletion is handled on request. We do not promise continuous availability, backup, recovery, retention, or preservation. Professionals should keep independent copies of important records.

5. No certification claims

Kioku makes no claim of HIPAA, PCI-DSS, SOC 2, ISO, or other certification or regulated compliance. Kioku is not designed to replace a Professional’s legal, security, licensing, or risk assessment.

6. Report a concern

Report suspected security issues to jwmcclung@gmail.com. Do not access other users’ data, disrupt the service, use automated exploitation, or disclose sensitive findings publicly before we have a reasonable opportunity to investigate.