Security at KUCO

Businesses run their daily operations on KUCO and share compliance information with the corporate customers they supply, so security is a design constraint, not an afterthought. This page describes our controls in plain language for business owners and in enough detail for a corporate IT or security team doing vendor due diligence.

• All traffic between your browser and KUCO is encrypted with TLS.
• All data is encrypted at rest (AES-256) in our managed database and file storage.
• Uploaded compliance documents live in private storage; access is via short-lived signed URLs, never public links.

• Every database table enforces row-level security: each business can only ever read and write its own records, enforced by the database itself, not just the application.
• Within a business, access follows the roles the owner assigns (owner, area manager, manager), and staff portal users see only their own lane.
• A corporate customer sees a supplier's compliance information only after that supplier accepts the relationship, only through the corporate's own reporting template, and sees a document only after the supplier explicitly shares it.
• Sessions expire on inactivity and privileged operations are re-verified server-side on every request.

KUCO runs on established managed infrastructure rather than self-operated servers: the database and storage layer is Supabase (SOC 2 Type II audited, running on AWS, which holds ISO 27001 and SOC 2 among others), and the application layer is served by Vercel (SOC 2 Type II and ISO 27001). KUCO itself does not yet hold its own ISO 27001 or SOC 2 certification; independent assurance beyond our providers' certifications is on our roadmap and we are happy to discuss timelines with corporate customers.

• The database is backed up daily by our managed database provider.
• We maintain an internal disaster recovery plan covering restore procedure, responsibilities and recovery targets, available to corporate customers on request under NDA.

• Compliance answers keep an append-only change history: who changed what, when, and whether a value was entered manually or computed from operational records.
• Document uploads are versioned, never overwritten, so the full history of any certificate is reconstructible.
• Billing and subscription changes are written to an audit log.

If you believe you have found a security vulnerability in KUCO, please email hello@kuco.co.za with the details. We will acknowledge your report, investigate promptly, and not pursue good-faith research conducted without harming user data or service availability.

Corporate security questionnaires and due diligence requests can be sent to hello@kuco.co.za. Our POPIA statement and Privacy Policy cover the data protection side of these questions.