Security & Privacy Statement

Data is encrypted in transit using TLS 1.3 and at rest using AES-256. Passwords are hashed and never stored in plain text.

Internal access to user data is restricted by role and logged. Two-factor authentication is available on every account, and we recommend enabling it.

We run continuous automated monitoring for unusual account activity, rate-limit authentication endpoints to slow brute-force attempts, and maintain an incident response process for investigating and disclosing any confirmed breach.

If you’ve found a security vulnerability, please report it to security@kestrion.com rather than disclosing it publicly. We investigate all reports and will follow up directly.

We currently maintain practices consistent with GDPR and CCPA requirements. A SOC 2 Type II audit is in progress; we’ll update this page once it’s complete. For how we handle your personal data specifically, see our Privacy Policy.