Security

Kasura runs on managed cloud infrastructure, including Google Firebase and related Google Cloud services for application hosting, authentication, and database storage. Physical security, network isolation, and data-center controls are inherited from those providers.

For a list of third-party services that may process data on our behalf, see Subprocessor List.

Infrastructure providers remain responsible for the physical security and resilience of their own facilities. Kasura is responsible for the secure configuration and operation of the Services running on that infrastructure.

Data is transmitted over encrypted connections (HTTPS/TLS) between browsers, mobile clients, and Kasura services. Data stored in our cloud infrastructure benefits from encryption at rest provided by our infrastructure providers.

Encryption protects data during transmission and storage but does not replace good security practices such as strong authentication, access management, and careful handling of sensitive information.

Account access is protected by email-and-password authentication managed through Firebase Authentication. Passwords are handled by the authentication provider — Kasura does not store plaintext passwords.

Sessions are issued after successful sign-in and are required to access owner and staff areas of the platform. End customers accessing a booking site or customer portal receive separate, scoped sessions tied to their booking context.

Email verification may be required before certain account actions. Internal Kasura users can optionally enable two-factor authentication with an authenticator app (TOTP). After enrollment, sign-in includes a second verification step. Two-factor authentication is not available for public rental customers.

Operators remain responsible for protecting account credentials, using strong passwords, enabling two-factor authentication where they choose to, and promptly removing access for users who no longer require access to their workspace.

Rental businesses can invite team members with scoped access inside their workspace. Permissions are enforced so staff can only perform actions allowed for their role within that business.

Account owners remain responsible for managing who has access, removing former staff, and protecting login credentials for their team.

Permissions are designed according to the principle of least privilege wherever reasonably practical, allowing users access only to the functionality required for their assigned role.

Kasura is built as a multi-tenant platform: many rental businesses share the same software, but each business's operational data is scoped to its own workspace. Application logic and access checks are designed to prevent one account from accessing another account's data.

Kasura regularly reviews application-level authorization logic as new platform features are introduced to help maintain appropriate separation between customer workspaces.

Kasura uses application monitoring and error tracking (including Sentry) to detect failures, diagnose issues, and improve reliability. Error reports may include technical context such as browser type, page URL, and stack traces.

We aim to avoid collecting unnecessary personal data in diagnostic logs. Monitoring data is used for engineering and support purposes, not sold to third parties.

Monitoring data is retained only for operational, diagnostic, support, reliability, and security purposes and is handled in accordance with our Privacy Notice.

If we become aware of a security incident that affects customer data, we investigate, contain, and remediate as appropriate. Where required by law or contract, we will notify affected customers without undue delay.

Breach notification for personal data we process on your behalf is described in our Data Processing Addendum. Report suspected incidents to security@kasura.app.

Following a confirmed security incident, Kasura reviews the underlying cause and may implement technical or operational improvements designed to reduce the likelihood of similar incidents in the future.

If you believe you have found a security vulnerability in Kasura, please report it to us responsibly. Do not access, modify, or exfiltrate data belonging to other users.

Report a security issue
security@kasura.app

Include steps to reproduce and the affected area
of the platform. We will acknowledge reports in
good faith.

See also our Privacy Notice and Acceptable Use Policy.

Responsible disclosure does not authorize testing against production systems, customer accounts, or infrastructure without prior written authorization from Kasura.

Kasura subscription billing is processed through Stripe. Operators may connect their own Stripe account to accept payments from end customers. See Payment Terms for merchant-of-record roles.

Kasura does not store full payment card numbers for subscription or end-customer checkout. Card data is handled by the relevant payment provider according to their security standards.

That statement concerns the payment checkout integration, not arbitrary files, messages, notes or support submissions. Do not upload or send full card numbers or card security codes. Identity documents can be submitted through supported rental-document features and require appropriate Operator access, necessity and retention decisions.

Operators remain responsible for maintaining compliant payment provider accounts and for following the security requirements published by their chosen payment provider.

Current production database and file storage are primarily configured in Google Cloud's asia-southeast1 region (Singapore). Application functions also operate in asia-southeast1 and us-central1. Authentication, hosting delivery, provider support, account metadata and other provider processing may use additional locations under the relevant provider terms; this is not an exclusive regional-storage promise.

The production Firestore database currently has seven-day point-in-time recovery, daily backups retained for seven days and database deletion protection. The production file bucket currently has object versioning, a lifecycle rule to delete noncurrent versions after 30 days, and seven-day soft delete. Lifecycle execution and recovery-copy expiry are provider processes, not a guarantee that every copy is erased at an exact deadline. These configurations may change with lawful operational requirements; no recovery time, recovery point or successful restore is guaranteed.

Backup and recovery features are not a substitute for a Customer's continuity planning. Active-system deletion is distinct from recovery-copy expiry as explained in the DPA and Privacy Notice. No tested restoration frequency, guaranteed restore outcome or recovery deadline is represented.

We work to keep Kasura available and stable, but interruptions can occur during maintenance, provider outages, or unexpected incidents.

Kasura provides a public status page at /status. During early access, this page provides general service information rather than real-time infrastructure monitoring or historical uptime metrics.

Planned maintenance may occasionally require temporary service interruptions. Where reasonably practical, Kasura will provide advance notice through appropriate communication channels.

No internet-connected service can guarantee absolute security. While Kasura implements reasonable technical and organizational safeguards, no security measure can completely eliminate every risk. Operators should maintain appropriate internal security practices, independent backups where appropriate, and business continuity procedures suitable for their own operations.

Security is shared. As a Kasura customer, you should:

• Use strong, unique passwords, enable two-factor authentication where available, and limit staff access to what each role needs
• Remove access for team members who no longer work with your business
• Keep your devices and browsers up to date
• Review connected payment and integration accounts regularly
• Contact us promptly if you suspect unauthorized access to your workspace
• Enable email verification where available and keep account recovery information current
• Review workspace activity regularly for unexpected changes
• Report suspected security issues promptly to security@kasura.app
• Keep connected integrations and payment provider accounts secure

Kasura LLC, 30 N Gould St Ste N, Sheridan, WY 82801, United States. Legal: legal@kasura.app. Privacy: privacy@kasura.app. Billing: billing@kasura.app. Support: support@kasura.app. Security: security@kasura.app. These contact channels do not provide a 24/7 service, guaranteed response time or service-level agreement.