Security Philosophy: Family memories are sacred. We design kyuc° to be strictly "Private by Default" across our database, storage buckets, and application code.
1. Encryption in Transit and at Rest
Every request between your browser and our servers is encrypted using modern TLS 1.3 with Strict Transport Security (HSTS). All recordings and image files are housed in cloud storage compliant with SOC 2 Type II and ISO 27001 standards.
2. Database-level Row Level Security (RLS)
We enforce PostgreSQL Row Level Security (RLS) on all data tables:
- Every story, audio track, and transcript is permanently bound to your authenticated user identifier.
- Unauthorized users cannot inspect, query, or enumerate other families' stories by guessing IDs or tampering with URLs.
- Only stories explicitly designated as public generate a secured, token-scoped share link.
3. Private Object Storage & Signed URLs
Audio files are stored in private storage containers. Instead of static, permanent public URLs, authorized media is served via expiring signed URLs generated strictly on-demand for legitimate account owners.
4. Modern Authentication & Abuse Prevention
- Secure Auth: Powered by PKCE (Proof Key for Code Exchange) with Google OAuth and HttpOnly session cookies.
- Security Headers: Full suite of Content Security Policy, strict frame isolation, and nosniff protections.
- Rate Limiting: Throttling on authentication and password reset endpoints to mitigate brute force attacks.
5. Vulnerability Disclosure
If you discover a security concern, please contact our security team at: security@kyuc.alignlab.com.