Security

What this platform does — and doesn't — do to protect you.

This page covers khavion.com itself: the site, the accounts, the Architecture Diagram Reviewer. It states only what the code actually implements, and it lists the gaps with the same weight as the controls. How we handle your systems during consulting engagements is on /trust.

Last reviewed 2026-07-20 · disclosure contact in security.txt

01 / Controls in place

Diagram privacy: The reviewer runs entirely in your browser. Uploaded diagrams are read with the File API and never sent to a server — verifiable in your own DevTools Network tab. Only the report JSON you explicitly save is transmitted.
Citations: Every report recommendation quotes provider documentation verbatim from a human-verified knowledge base. The software cannot generate a citation; an automated job re-fetches every quote against the live page and disables any that drift.
Passwords: Hashed with scrypt (never stored or logged in plain text), checked against the Have I Been Pwned breach corpus at signup and reset via k-anonymity — only 5 characters of a hash ever leave the server.
Sessions: Signed, short-lived (60-minute) tokens in httpOnly, SameSite cookies. A password reset revokes every outstanding session. Reset links are single-use and expire in an hour.
Abuse controls: Per-IP and per-account rate limits held in a shared Redis store, same-origin checks on every state-changing request, request body size caps, and uniform responses that don't reveal whether an email has an account.
Audit trail: Security-relevant events (sign-ins, resets, limit trips, billing changes) are recorded durably. Emails and IP addresses in that trail are stored only as salted hashes — correlatable during an incident, useless as a directory.
Transport & headers: HTTPS everywhere with HSTS (preloaded), a restrictive Content-Security-Policy, frame-ancestors 'none', nosniff, and a minimal referrer policy. Cross-origin requests to the APIs are rejected.
Payments: Card details never touch this site. Checkout and billing management happen on Stripe's hosted pages; we store only the subscription state Stripe reports to us over signed, replay-protected webhooks.
Backups: The database is dumped nightly, encrypted, and retained for 90 days — and every nightly backup is restore-TESTED automatically into a scratch database with row counts verified. Recovery procedures are written down and rehearsed by machine, not aspiration.
Dependencies & code: CI blocks known-vulnerable dependencies (high severity and up), scans the full git history for leaked secrets on every push, and runs the browser-level test suite before anything deploys. Accepted findings are documented with reasons, not hidden.

02 / What we hold

The complete inventory of data this platform stores. If it isn't on this list, we don't have it — most notably, your diagrams never reach us at all.

Account data: email + password hash
Saved reports: report JSON only — never diagrams
Usage counters: delivered-report counts per company domain per month
Audit/error logs: hashed identifiers, 90-day intent
Payment data: held by Stripe, not us
Analytics: aggregate page counts, no cookies, no user IDs

03 / Subprocessors

The services this platform runs on, what each one touches, and where. This list changes only with a change to this page.

Vercel: Hosting and serverless compute · US (primary: Washington, D.C. region)
Neon: Postgres database (accounts, reports, usage) · US (AWS us-east-1)
Resend: Transactional email (verify, reset, report delivery) · US
Stripe: Payments and subscription billing · US
Zoho: CRM (lead follow-up) and business email · US datacenters
GitHub: Source code, CI, encrypted database backups · US
GoDaddy: DNS for khavion.com · US

04 / Retention and deletion

Account and saved reports: kept until you delete them or your account. Deleting your account permanently removes the account row, every saved report, and usage counters — immediately, not on a schedule.
Audit and error events: kept for incident forensics; identifiers are stored only as salted hashes from the moment of capture.
Encrypted database backups: expire automatically after 90 days. A deleted account therefore fully leaves the backup horizon within 90 days of deletion.
Emails we send (verify, reset, report copies): the delivery provider (Resend) retains send metadata per its policy; report emails contain your report, so treat your inbox as your copy.
Stripe retains billing records as required by financial regulation — that retention is theirs, not ours.

Deletion is self-serve: signed-in users can delete their account — and everything it holds — from their account page, no email thread required.

05 / What we don't have — yet

The section vendor security pages usually skip. These are deliberate, reasoned gaps — if one of them blocks your review, say so and it moves up the list.

No SOC 2 or ISO 27001

A SOC 2 audit alone runs roughly $10,000-$50,000 (Vanta's own published range) before the compliance platform on top. At this company's size that money is better spent on the controls themselves. The controls above are real; the badge will come when the revenue justifies it. Ask us anything a questionnaire would — we answer directly.

No formal penetration test yet

The codebase ships with automated security tests (auth flows, webhook signature verification, rate-limit behavior, secret scanning), but no third party has been paid to attack it. If your review requires one, tell us — it moves up the list when a customer needs it.

No MFA on tool accounts yet

Tool accounts protect saved report history — not money or infrastructure. MFA lands together with the first admin role. Password protections (breach screening, scrypt, single-use resets, session revocation) are already in place.

Two accepted CSP compromises

The Content-Security-Policy allows inline scripts (a Next.js static-rendering trade-off; the site hosts no user-generated HTML) and WebAssembly evaluation (required for the in-browser OCR that keeps your diagram off our servers — the privacy feature is worth the directive).

One-hour platform logs, mitigated

Our hosting tier retains runtime logs for one hour. That's why security events and server errors are ALSO written to our own database — the durable trail is ours, not the platform's.

Security questionnaires (CAIQ, SIG, or your own) are answered directly by the person who wrote this codebase — email zkhawaja@khavion.com.