SecurityBuiltInto
Every Layer of the Network
How KobKlein protects accounts and money today: encrypted storage and connections, layered access controls, transfer risk checks and an audit trail, described plainly, including what has not yet been independently certified.
How We Protect Accounts and Money
Six controls that are in place today.
Encryption at rest and in transit
Customer data is stored in encrypted databases and storage, and connections to the platform use TLS 1.2 or higher.
Two-factor authentication
Two-factor sign-in with an authenticator app is available for your account.
Transfer risk checks
Transfers pass automated risk checks that can hold or block suspicious activity for review.
Sanctions screening
Accounts and transfers are screened against sanctions and politically-exposed-person lists.
Audit trail
Sensitive actions are written to an audit log that cannot be edited after the fact, and infrastructure activity is recorded with tamper-evident logging.
Emergency controls
Operators can suspend transfers, cash movements, top-ups, currency exchange and card issuance immediately if something looks wrong.
Security Architecture
Defense in depth: several independent layers protect the KobKlein network.
Application Layer
Input validation, rate limiting, secure session handling and security headers (including HSTS and a Content Security Policy) protect the apps and the API against common web vulnerabilities.
Network Layer
The API sits behind a web application firewall with managed rule sets and rate limits, and is served over HTTPS.
Data Layer
Databases and file storage are encrypted at rest. The database is backed up automatically, with an extra snapshot taken before every production deployment.
Infrastructure Layer
The platform runs on AWS with automated health checks, and automated infrastructure alerts are sent to the engineering team.
Standards and Certifications: Where We Stand
We would rather be exact than impressive. Our cloud provider holds its own certifications (including SOC 2, ISO 27001 and PCI DSS Level 1); those belong to AWS and are not KobKlein certifications.
PCI DSS
Scope: Card payments
Card payments are handled by Stripe, a PCI DSS Level 1 service provider. Card numbers do not pass through KobKlein's servers. KobKlein has not itself been assessed against PCI DSS.
SOC 2
Scope: Security, availability, confidentiality
KobKlein does not hold a SOC 2 report. We track our controls internally and plan an independent audit after public launch.
Independent penetration test
Scope: Before public launch
An independent penetration test is planned before public launch. None has been completed yet, and we will say so on this page when one has.
What Is in Place Today
Web application firewall with managed rule sets and rate limits in front of the API
Encrypted databases and storage; encrypted connections (TLS 1.2 or higher)
Immutable audit log of sensitive actions and tamper-evident infrastructure logging
Automated database backups plus a snapshot before every production deployment
Role-based access, with a second approver required for sensitive admin actions
Sanctions and politically-exposed-person screening
Emergency switches that can suspend transfers, cash movements, top-ups, currency exchange and card issuance
Error monitoring configured not to collect personal data
Report a Vulnerability
Found a security issue? Please tell us before sharing it publicly. We read every report. We do not currently run a paid bug-bounty program.
Security Contact
Found a vulnerability or have a security concern? Write to us and we will respond.
Email: support@kobklein.com
Security Is Infrastructure
Security is not a feature we added, it is how the KobKlein network was architected. Encrypted storage, automated alerts and layered access controls protect every participant on the network.