Data Security

This page describes the technical and organisational measures we use to keep your data safe. It complements our Privacy Policy.

Transport & storage

• HTTPS everywhere. All traffic between your browser and our servers is encrypted with TLS. Both hosting providers issue certificates from Let's Encrypt via Vercel/Cloudflare respectively.
• Backend on Railway with a persistent SQLite volume. Database is not exposed to the public internet.
• Frontend on Vercel — static assets and serverless functions delivered from Vercel's global edge network.

Authentication

• Google Sign-In for account creation — we never see your Google password.
• JWTs signed with a rotatable HS256 key. Tokens expire after 30 days.
• Session ownership checks on every user-scoped route (/chart, /chat, /term-example, /transit) — one account cannot read another's data.
• Central 401/403 handling — expired or revoked tokens are cleared client-side the moment the server rejects them.

Local device data

We use browser localStorage for the JWT, cached profiles, and notes so the app can work responsively and offline-ish. This data is bound to your browser and is not accessible to other sites. The Delete Everything button on the Me tab wipes localStorage and signs you out in one action.

Access control

• Access to the Anthropic API key, JWT signing key, and Google OAuth secret is restricted to the operator (Nitin Goswami). Keys are stored as encrypted secrets in Railway and never appear in code or version control.
• Server logs are retained for troubleshooting, contain minimal identifiers, and are rotated periodically.

Third-party processors

• Anthropic — chat messages are transmitted over TLS to the Claude API for reading generation. Anthropic's security posture governs storage on their side.
• Google — sign-in flow.
• Vercel + Railway — hosting providers with their own SOC 2 / ISO 27001 attestations.

Vulnerability disclosure

Found a security issue? Please email admin@kalatomlabs.com with subject "Security:". We will acknowledge within 48 hours and coordinate a fix. Please do not publicly disclose the issue before we have had a reasonable chance to remediate.

Incident response

In the event of a personal-data breach, we will notify affected users and, where required by law, the Data Protection Board of India, within the timelines mandated by the DPDP Act 2023.

What we do not do

• We do not sell your data.
• We do not use cross-site tracking cookies.
• We do not embed third-party ad networks or trackers.
• We do not run behavioural profiling on your chart or chat history.