Security

Kasura runs on managed cloud infrastructure, including Google Firebase and related Google Cloud services for application hosting, authentication, and database storage. Physical security, network isolation, and data-center controls are inherited from those providers.

For a list of third-party services that may process data on our behalf, see Subprocessors.

Infrastructure providers remain responsible for the physical security and resilience of their own facilities. Kasura is responsible for the secure configuration and operation of the Services running on that infrastructure.

Data is transmitted over encrypted connections (HTTPS/TLS) between browsers, mobile clients, and Kasura services. Data stored in our cloud infrastructure benefits from encryption at rest provided by our infrastructure providers.

Encryption protects data during transmission and storage but does not replace good security practices such as strong authentication, access management, and careful handling of sensitive information.

Account access is protected by email-and-password authentication managed through Firebase Authentication. Passwords are handled by the authentication provider — Kasura does not store plaintext passwords.

Sessions are issued after successful sign-in and are required to access owner and staff areas of the platform. End customers accessing a booking site or customer portal receive separate, scoped sessions tied to their booking context.

Email verification may be required before certain account actions. Multi-factor authentication is not currently offered for all accounts.

Operators remain responsible for protecting account credentials, using strong passwords, and promptly removing access for users who no longer require access to their workspace.

Rental businesses can invite team members with scoped access inside their workspace. Permissions are enforced so staff can only perform actions allowed for their role within that business.

Account owners remain responsible for managing who has access, removing former staff, and protecting login credentials for their team.

Permissions are designed according to the principle of least privilege wherever reasonably practical, allowing users access only to the functionality required for their assigned role.

Kasura is built as a multi-tenant platform: many rental businesses share the same software, but each business's operational data is scoped to its own workspace. Application logic and access checks are designed to prevent one account from accessing another account's data.

Kasura regularly reviews application-level authorization logic as new platform features are introduced to help maintain appropriate separation between customer workspaces.

Kasura uses application monitoring and error tracking (including Sentry) to detect failures, diagnose issues, and improve reliability. Error reports may include technical context such as browser type, page URL, and stack traces.

We aim to avoid collecting unnecessary personal data in diagnostic logs. Monitoring data is used for engineering and support purposes, not sold to third parties.

Monitoring data is retained only for operational, diagnostic, support, reliability, and security purposes and is handled in accordance with our Privacy Policy.

If we become aware of a security incident that affects customer data, we investigate, contain, and remediate as appropriate. Where required by law or contract, we will notify affected customers without undue delay.

Breach notification for personal data we process on your behalf is described in our Data Processing Agreement. Report suspected incidents to security@kasura.app.

Following a confirmed security incident, Kasura reviews the underlying cause and may implement technical or operational improvements designed to reduce the likelihood of similar incidents in the future.

If you believe you have found a security vulnerability in Kasura, please report it to us responsibly. Do not access, modify, or exfiltrate data belonging to other users.

Report a security issue
security@kasura.app

Include steps to reproduce and the affected area
of the platform. We will acknowledge reports in
good faith.

See also our Privacy Policy and Acceptable Use Policy.

Responsible disclosure does not authorize testing against production systems, customer accounts, or infrastructure without prior written authorization from Kasura.

Kasura subscription billing is processed through Stripe. Operators may connect their own Stripe account to accept payments from end customers. See Payment Terms for merchant-of-record roles.

Kasura does not store full payment card numbers for subscription or end-customer checkout. Card data is handled by the relevant payment provider according to their security standards.

Operators remain responsible for maintaining compliant payment provider accounts and for following the security requirements published by their chosen payment provider.

Core platform data benefits from backup and recovery capabilities provided by our cloud infrastructure. Backup frequency and retention are managed at the infrastructure layer.

Operators should maintain their own business records and exports where required for compliance or continuity. Kasura provides data export features where available in the product.

Restoration procedures may be tested periodically as part of operational maintenance. Backup retention periods and recovery capabilities may evolve as platform infrastructure changes.

We work to keep Kasura available and stable, but interruptions can occur during maintenance, provider outages, or unexpected incidents.

Kasura provides a public status page at /status. During early access, this page provides general service information rather than real-time infrastructure monitoring or historical uptime metrics.

Planned maintenance may occasionally require temporary service interruptions. Where reasonably practical, Kasura will provide advance notice through appropriate communication channels.

No internet-connected service can guarantee absolute security. While Kasura implements reasonable technical and organizational safeguards, no security measure can completely eliminate every risk. Operators should maintain appropriate internal security practices, independent backups where appropriate, and business continuity procedures suitable for their own operations.

Security is shared. As a Kasura customer, you should:

• Use strong, unique passwords and limit staff access to what each role needs
• Remove access for team members who no longer work with your business
• Keep your devices and browsers up to date
• Review connected payment and integration accounts regularly
• Contact us promptly if you suspect unauthorized access to your workspace
• Enable email verification where available and keep account recovery information current
• Review workspace activity regularly for unexpected changes
• Report suspected security issues promptly to security@kasura.app
• Keep connected integrations and payment provider accounts secure