Security

What we do to keep your organization's information safe, in plain words, and what we are still working on. We only list things that are in place today.

Security questionnaire answers Status and uptime Report a weakness

Your information stays yours alone

Every organization's information is kept apart from every other organization's. Every screen and every download is limited to the signed-in person's own organization, and we test this automatically before every release.
People only see what their role allows. Administrators decide who can do what.
Kaam360 staff do not browse your projects or files. The platform panel shows only organization-level facts, such as plan and number of people.

Signing in

Passwords are stored scrambled, never in readable form, and cannot be looked up by us.
Too many wrong passwords lock the account for a while, and sign-in, password-reset and sign-up attempts are limited per address.
Two-step sign-in (a code from an authenticator app on a phone) is available to everyone. Administrators can make it compulsory for the whole organization and help someone who has lost their phone. Our own platform panel supports it too.
Single sign-on (SAML) with Okta, Microsoft Entra ID, Google Workspace or any SAML 2.0 identity provider. Every answer must be signed by your provider and is checked for its audience, address, age and one-time use. Organizations can verify their email domains, make single sign-on the only way in (with break-glass administrators) and give roles from groups.
Allowed networks: an organization can limit Kaam360 to its own office or company networks. Anyone elsewhere sees an explanation instead of the page.
Switching a person off signs them out within a minute.
Sessions expire if they are left unused for a long time, and anyone can sign out at any time.

Encryption

In transit: every connection to Kaam360 is encrypted (HTTPS), and browsers are told to use only HTTPS for this site for a year. Sign-in cookies are only ever sent over HTTPS. Connections to the mail server are encrypted too.
Backups: every backup copy is locked with strong encryption (AES-256) on our server before it leaves it. Only we hold the key, so the storage company cannot read it.
Passwords, API keys and the access tokens of connected apps are stored only in scrambled (hashed) form. Secret settings, such as the keys for payments and email, are sealed on the server.
What is not encrypted by Kaam360 itself: the live database and uploaded files on our server. They are protected by the server's access controls and are only handed out to people who may see them, each organization's files in its own folder.
Payments are handled by Paddle. Card details never reach Kaam360.

Backups and restore tests

Every night the whole database and every uploaded file are copied, encrypted and sent to a separate storage company (Backblaze), away from our server. The newest 30 nightly copies are kept, and an old copy is removed only after a new one has arrived safely.
The database is also copied on the server right before every update of Kaam360, so an update can be undone.
If a nightly copy fails, we are emailed and it is tried again a few hours later.
We test that backups can really be opened: a restore test on the server puts a copy into a separate database and compares every table. A backup that cannot be opened, or a wrong key, is refused by the restore tool.

Seeing what happened

An activity log shows administrators who signed in (and who failed to), who changed a password, added or switched off a person, changed rights or settings, downloaded the data or asked for deletion. It is kept for about a year. Passwords and codes are never written to it.
Our own platform panel keeps its own log of everything its administrators do.

Where your information is kept

On a server that we rent from Velia (velia.net), which runs Kaam360 and its database. Encrypted backup copies are kept with Backblaze.
Country of the data centre: France.
The companies that help us run Kaam360, and what each one handles, are listed on our Data processing page: Velia (hosting), Cloudflare (the network in front of the website), Backblaze (encrypted backups), Hostinger (email), Paddle (payments) and, only if your organization switches on the AI assistant, Anthropic.

Your control over your data

An administrator can download everything the organization has put in, as spreadsheets plus files.
An administrator can delete the whole organization. It is erased after a 14-day delay that can be cancelled. See Data processing for details.
When a trial or subscription ends, the workspace becomes read-only first; your information is not removed.

Is Kaam360 up?

Our status page shows whether Kaam360 is working, the uptime of the last 90 days, current incidents and planned maintenance. It is checked every 5 minutes from outside our network and hosted separately, so it works even when Kaam360 does not. You can ask for an email when something is wrong.

How we work, and testing

Every change to Kaam360 is reviewed and must pass several hundred automatic tests (including the checks that keep organizations apart) before it can go live. Updates are started by hand and back up the database first.
We have written security policies for access, changes, incidents, backups, the companies we use, keeping and deleting data, and business continuity, including a review of who has access every quarter.
In October 2026 we reviewed our own code and settings for security problems (sign-in, rights, browser protections, limits, uploads, outside addresses, database access and secrets) and fixed what we found.
Independent testing and certification. Kaam360 has not yet been tested by an outside security company, and has not been through an outside audit such as SOC 2 or ISO 27001. We will say so here when it has.
Legal documents. Our Terms, Privacy and Data processing pages are drafts still being reviewed.

Doing a security review of Kaam360? Our security questionnaire answers cover about 70 usual questions, and can be downloaded as Word or PDF.

Found a problem?

If you think you have found a security weakness, please tell us through Help & support inside the app, or contact us if you are not yet a customer. Please give us a reasonable time to fix it before telling others. We will not take action against anyone who reports a problem in good faith.

Security researchers can also find this in our security.txt file.