Security
Security built into every layer of the platform
Your store holds balances, codes and customer documents. Here is exactly what Kavia Commerce does to protect them, in the code, on every channel: website, Telegram bot, reseller API and admin panel.
Sign-in and accounts
- Passwords are hashed with argon2; we never store them in readable form.
- Two-step sign-in with an authenticator app (TOTP) and one-time recovery codes.
- A list of signed-in devices and sessions, with sign-out for each device.
- Account lockout after repeated failed sign-ins, plus per-IP rate limits.
- Throwaway e-mail inboxes are refused at sign-up.
- A confirmed e-mail address is required before payment reports, seller applications, sell requests or identity checks.
Balances and orders
- Every wallet movement is a new, immutable ledger entry. A balance is never overwritten.
- Each deposit is recorded once: the network and transaction hash pair is unique.
- Reseller orders are idempotent: a repeated request with the same API key and external order ID cannot create or charge a second order.
Identity documents and data
- Uploaded identity documents are re-encoded, removing EXIF and GPS data.
- Documents are stored encrypted, and every staff view of a document is written to the audit log.
- All user text is validated on the server: names and forms accept no HTML, script or template syntax, and everything is escaped when shown.
Admin panel and staff
- Staff permissions are role-based: each person sees and changes only what their role allows.
- Every admin action is written to an audit log: who did what, and when.
Reseller API
- API keys are shown once when created and stored only as hashes.
- Each key can be limited to an allow-list of IP addresses.
- Each key has its own rate limit.
Website and browser
- Session cookies are HttpOnly and Secure, out of reach of page scripts.
- HSTS keeps browsers on HTTPS.
- A strict Content Security Policy limits which scripts a page may run.
Ready-made websites
Ready-made business websites are a separate product with their own protections:
- The panel password is stored as a salted scrypt hash; the first password is generated at random and checked with a timing-safe comparison.
- The session cookie is HttpOnly, SameSite=Strict and Secure.
- Panel requests are protected against CSRF.
- Rate limits: 6 panel sign-in attempts per IP every 15 minutes, 8 contact form sends per IP every 10 minutes.
- Request size is limited, saved content is validated on the server, and uploaded images are checked by their file signature.
- Panel actions are written to an audit log, and the last 50 content versions are kept as backups.
- The license key is signed with Ed25519 and bound to the domain and the theme.
- Pages are generated as static HTML, with all text escaped.
HTTPS depends on the server the site runs on; the product itself does not provide it.
What we do not claim
We do not hold ISO 27001, SOC 2 or PCI DSS certifications and have not published a penetration test report. If your business needs a security questionnaire, we answer it in writing.
Found a vulnerability? See how to report it on the Trust Center. Trust Center
Let’s talk about your project
Tell us briefly what you need. We usually reply within one business day.