Built for money in motion

Data Protection

We employ defense-in-depth security to protect your sensitive information at every layer:

Encryption

• In Transit: All connections use TLS 1.2 or higher. We enforce HSTS (HTTP Strict Transport Security) and support perfect forward secrecy.
• At Rest: All databases and file storage use AES-256 encryption. Encryption keys are managed through dedicated key management services with automatic rotation.
• Application-Layer: Sensitive fields (bank account numbers, tax IDs, API keys) are encrypted at the application layer before database storage, providing an additional layer of protection beyond disk encryption.

Access Controls

• Role-based access control (RBAC) with least-privilege principles across all internal systems.
• Multi-factor authentication (MFA) required for all employee access to production systems and sensitive data.
• Comprehensive audit logging of all access to customer data and administrative actions.
• Automated access reviews and immediate deprovisioning upon personnel changes.

Data Isolation & Backups

• Customer data is logically isolated to prevent unauthorized cross-account access.
• Automated daily backups with point-in-time recovery capability.
• Backups are encrypted and stored in geographically separate locations.
• Regular backup restoration testing to verify data integrity.

Payment Security

Payment processing is handled through industry-leading infrastructure with multiple layers of protection:

• PCI DSS Level 1: All card payments are processed through Stripe, which maintains the highest level of PCI DSS certification. Full card numbers never touch our servers.
• Tokenization: Payment methods are tokenized, meaning we store secure references rather than actual card or bank account numbers.
• 3D Secure (3DS):We support 3D Secure authentication for card payments, adding an extra verification step with the cardholder's bank.
• Fraud Detection: Real-time machine learning models analyze every transaction for fraud signals, including velocity checks, device fingerprinting, and behavioral analysis.
• Secure Webhooks: All webhook payloads are cryptographically signed and verified to prevent tampering.
• API Security: API keys are hashed before storage, rate-limited, and can be scoped with granular permissions.

Account Security

We provide and recommend multiple layers of protection for your Keeal account:

• Password Security: Passwords are hashed using industry-standard algorithms (bcrypt/argon2). Plaintext passwords are never stored or logged.
• Two-Factor Authentication (2FA): Available via authenticator app (TOTP) or SMS. We strongly recommend enabling 2FA for all accounts.
• Session Management: Sessions are cryptographically secured with automatic expiration. You can view and revoke active sessions from your account settings.
• Login Monitoring: We track login attempts and notify you of sign-ins from new devices or unusual locations.
• Email Verification: All email changes require verification of both the old and new email addresses.

Compliance Standards

Keeal adheres to financial regulations and international security standards:

Infrastructure Security

Our infrastructure is designed for security, reliability, and performance:

• DDoS Protection: Automatic detection and mitigation of distributed denial-of-service attacks at the network edge.
• Web Application Firewall (WAF): Filters and blocks malicious traffic, including SQL injection, XSS, and other OWASP Top 10 attack vectors.
• Network Isolation: Production environments are isolated from development and staging, with strict firewall rules controlling all traffic.
• Container Security: Applications run in isolated containers with minimal attack surface and no root privileges.
• Dependency Management: Automated scanning of third-party dependencies for known vulnerabilities with rapid patching processes.
• Immutable Deployments: Infrastructure is deployed through code (IaC) with version-controlled, repeatable, and auditable configurations.

Incident Response

We maintain a comprehensive incident response program to detect, respond to, and recover from security events:

• Detection: Continuous monitoring with automated alerting for anomalous activity, failed login attempts, unusual transaction patterns, and infrastructure events.
• Response: Documented incident response procedures with defined roles, escalation paths, and communication protocols.
• Notification: In the event of a security breach affecting your data, we will notify you without undue delay (and within 72 hours where required by GDPR).
• Recovery: Business continuity and disaster recovery plans with defined recovery time objectives (RTO) and recovery point objectives (RPO).
• Post-Incident: Thorough root cause analysis and implementation of preventive measures after every incident.

Responsible Disclosure

We value the security research community and welcome responsible disclosure of vulnerabilities. If you discover a security issue, please report it to us:

When reporting, please include:

• A detailed description of the vulnerability and its potential impact.
• Steps to reproduce the issue.
• Any supporting evidence (screenshots, logs, PoC code).

We ask that you give us reasonable time to address the issue before any public disclosure. We will not take legal action against security researchers who report vulnerabilities in good faith and follow responsible disclosure practices.

Your Security Responsibilities

Security is a shared responsibility. Help us keep your account safe:

Security Questions?

If you have security concerns, believe your account has been compromised, or want to report a vulnerability, please contact our security team: