Security & Data Protection Policy
Koana Works runs Koana, a records and meetings platform for clubs, societies and non-profits. This policy describes how we protect the information organizations keep in Koana, including information received from connected services such as Google, Zoom, Facebook, Instagram and Threads.
1. Where data lives
- Application: Cloudflare Workers (app.koanaworks.com and related addresses).
- Database and sign-in: Supabase (PostgreSQL and Supabase Auth), hosted in the United States.
- Files and private keys: Cloudflare R2 private storage, reachable only by Koana's server.
We choose providers that maintain recognised security programmes (for example SOC 2) and encrypt data at rest.
2. Encryption
- In transit: every connection uses HTTPS with TLS 1.2 or higher. This covers browsers to Koana, Koana to its database, and Koana to Google, Zoom and Meta.
- At rest: the database and file storage are encrypted at rest by our providers.
- Connected-account keys (OAuth refresh and page tokens for Google, Zoom, Meta and Threads) receive extra protection:
- Koana encrypts them a second time with AES-256-GCM and keeps them only in private storage.
- They are never written to the database, never sent to browsers and never logged.
- Short-lived access tokens are held in server memory only.
3. Access control
- Row-level security: every database table enforces it. Members can only reach their own organization's data, and actions such as finance, officer tools and integrations are limited by role.
- Private by default: private comments and personal notes are enforced in the database, so they stay hidden from officers too.
- Server checks: before any action on a connected service, the server checks the person's Koana session and their role.
- Least privilege: integrations request the narrowest permissions available. For example, Google Calendar only manages a calendar Koana creates, and Zoom only manages meetings Koana schedules.
- Administrative access to Cloudflare, Supabase, GitHub, Google Cloud, Zoom and Meta:
- is limited to named Koana Works administrators;
- requires multi-factor authentication;
- is reviewed when people join or leave.
- Staff access to customer data: Koana staff do not browse customer data. Access happens only to operate or support the service, at an organization's request, or where the law requires it.
4. Secrets
- API secrets are stored only as encrypted secrets in Cloudflare and Supabase, never in source code.
- Every code change is scanned automatically for accidentally committed secrets.
- Secrets are rotated when a person with access leaves, after any suspected exposure, and when a provider recommends it.
5. Dependencies and updates
- Third-party packages are pinned in a lockfile.
- Automated weekly checks report outdated or vulnerable packages, and proposed updates arrive as reviewed pull requests.
- Every change runs type checks, linting, tests and a production build before it is deployed.
6. Security testing and vulnerability handling
- Automated testing: runs on every change and weekly. It includes static code analysis (SAST), secret scanning, dependency audit, and a weekly dynamic scan (DAST) of the live application. Reports are kept for 90 days.
- Target fix times: from confirmation, critical issues are fixed within 7 days, high within 30 days, and medium within 90 days. Low-risk findings are fixed during normal maintenance.
- Reporting: anyone can report a security concern to contact@koanaworks.com. We acknowledge reports within 3 business days and do not pursue good-faith researchers.
7. Monitoring and incidents
Application errors are recorded and reviewed. Suspected security incidents follow our incident response procedure.