Security

Email security@kodar.io. This is the address published in our /.well-known/security.txt and it is monitored as a security channel — use it in preference to support or sales.

Include what you found, the URL or endpoint, the steps to reproduce it, and what you believe an attacker could do with it. If your report involves personal data, tell us what you saw but please do not attach it. We aim to acknowledge every report within three business days and to keep you updated until it is resolved.

Test against your own account and your own documents. Do not access, modify, or retain anyone else's data, and never complete a signature using another person's identity — a qualified signature is legally binding on the person it names.

Out of scope: denial-of-service and load testing, spam or social engineering aimed at our staff, customers or signers, physical attacks, and anything against our providers' own infrastructure rather than ours. Attacks against the Smart-ID / Mobile-ID services operated by SK ID Solutions belong to SK ID Solutions, not to us.

If you follow the guidance above, act in good faith, and give us a reasonable opportunity to fix the issue before disclosing it publicly, we will not pursue or support legal action against you for your research, and we will credit you if you would like to be credited.

We do not currently run a paid bug-bounty programme — we would rather say so plainly than leave you guessing about a reward.

Where we process a customer's data as their processor, we notify that customer without undue delay after becoming aware of a personal-data breach affecting it, with the information they need to meet their own Art. 33/34 obligations — the commitment made in §6 of the DPA. Where we are the controller — accounts, billing and the platform records described in the Privacy Policy — we notify the Estonian Data Protection Inspectorate within 72 hours where the breach meets the Art. 33 threshold, and the people affected where Art. 34 requires it.

If you believe personal data has been exposed, that is a report we want immediately, at security@kodar.io. Data-protection questions that are not urgent go to privacy@kodar.io.

Identity and access. Sign-in credentials are hashed by our identity provider and never stored by this application. Every page and API call is scoped to one workspace. Developer API keys and team invitations are stored only as SHA-256 hashes — the secret exists once, at the moment it is shown to you, and cannot be recovered from our database.

Signing links. A signing link is cryptographically bound to one signer and one document and is single-use: the token is invalidated the moment it is consumed, so an intercepted URL cannot be replayed.

Transport and browser hardening. HTTPS with HSTS (preloaded), a Content Security Policy that permits no third-party scripts, framing blocked outright (frame-ancestors 'none' plus X-Frame-Options: DENY), MIME sniffing off, and a restrictive referrer and permissions policy.

Outbound requests. Customer-configured webhooks are checked against private and link-local address ranges with DNS re-resolved at the moment of sending, so a hostname cannot be rebound to an internal address between validation and delivery.

Data minimisation and expiry.The developer API never returns a signer's national identity code. A nightly job expires the operational data that does not need to be kept — the periods are published in §6 of the Privacy Policy. Documents and signed containers are never expired by us; erasing them is the customer's decision, per document or per workspace.

Evidence.Signatures are produced by SK ID Solutions as a qualified trust service and sealed into ASiC-E containers with qualified timestamps and OCSP validity proofs, so a container's integrity can be verified independently of us — including after you stop being a customer.

The categories of data we process, who processes them for us, and where they are stored are set out in the Data Processing Agreement (§2 and §4) and the Privacy Policy. Customers who need a signed DPA, our sub-processor list in writing, or answers to a security questionnaire should write to privacy@kodar.io.