What is protected today, and what is on the roadmap.
Kalawer separates two conversations: the concrete controls protecting the current public lead-intake, and the target Production trust architecture required before the authenticated application is used with institutional data.
Kalawer does not claim SOC 2, ISO, GDPR certification, DPO appointment, or verified data-residency guarantees. This page is not a substitute for a security questionnaire under NDA.
Current lead-intake protections
These controls apply to the public pilot enquiry form and the underlying /api/public/lead-intake server route on https://kalawer.com today.
- Server-side origin allow-list on the pilot endpoint (no wildcards).
- Row Level Security on lead-intake tables; anonymous and authenticated SQL access denied.
- Atomic peppered-bucket rate limits (5 per 15 minutes, 20 per 24 hours) with server-side row locking.
- Honeypot and idempotency handling that never inserts rows for detected abuse.
- Network identifiers stored only in a short-lived rate-limit table (≤ 48 hours) and never linked to the lead record.
- TLS on the canonical https://kalawer.com origin; www redirects to the canonical origin.
Target Production trust architecture
The following controls are architectural requirements before the authenticated Kalawer application is used with real institutional data. They are delivered progressively during the paid design-partner pilot; they are not features of the currently deployed public site.
- • Organization boundaries enforced at the data layer, not just the UI.
- • Evidence scoped to the strategy and organization that owns it.
- • Every action key mapped to an explicit role, enforced server-side.
- • Client rendering never treated as the source of truth for permissions.
- • Structural segregation of duties between author and validator.
- • No automated path advances a strategy without a named human decision.
- • Approvals and rejections recorded as events that cannot be silently edited.
- • Append-only artefact, finding, and decision history with author + timestamp.
Institutional security review, penetration testing, and formal certifications belong to the pilot and post-pilot programme.
Request a design-partner pilot