Security at Koolay

Last updated 2026-04-17

Koolay hosts sensitive nonprofit data — donor records, payment history, member PII, scholarship applications, user accounts. This page summarizes how we protect it.

Certifications and compliance

SOC 2 Type II	🟡 Readiness phase — target report Q3 2026
GDPR	✅ DPA on file, EU SCCs executed, self-service data export and deletion
CCPA / CPRA	✅ Honored; Koolay does not sell personal information
PCI DSS	✅ All card data handled by Stripe (PCI Level 1); we never see card numbers
HIPAA	⚪ Not required — we do not process health data

Subprocessor certifications we rely on: Supabase SOC 2 Type II, Vercel SOC 2 Type II, Stripe PCI DSS Level 1 / SOC 1/2, AWS SOC 1/2/3 and ISO 27001.

Infrastructure

• Hosting: Supabase on AWS US-East-1 (primary), Vercel global edge CDN
• Encryption at rest: AES-256 (Supabase managed keys + encrypted secrets vault via pgcrypto)
• Encryption in transit: TLS 1.2+ everywhere (HSTS enabled)
• Tenant isolation: Row-Level Security (RLS) on every multi-tenant table
• Backups: Daily snapshots with 7-day point-in-time recovery. Weekly off-platform encrypted exports retained 30 days.

Access control

• Single Sign-On: via Supabase Auth
• Multi-Factor Authentication: mandatory for admin accounts (TOTP)
• Password policy: minimum 12 characters, mixed case, digits, symbols
• Principle of least privilege: service role keys scoped narrowly; admin access role-based per tenant
• Quarterly access reviews: staff and subprocessor credentials reviewed each calendar quarter
• Audit logging: every mutation on sensitive tables (donations, donors, memberships, scholarship applications, user roles, volunteers, contact submissions, newsletter subscribers, event raffle tickets, donor stewardship) is recorded with actor, timestamp, and before/after state (with PII redacted). Admins can review at Admin → Settings → Audit Log.

Data handling

• Customer Data is segregated by tenant via RLS. Tenants cannot read each other's data.
• Customer Data is never used for AI model training. OpenAI and Anthropic operate under zero-retention agreements for API usage.
• Self-service data export: Admin → Settings → GDPR → Export
• Self-service data deletion: Admin → Settings → GDPR → immediate irreversible purge
• If an account is closed without explicit deletion, data is auto-purged after 90 days. Backup copies are purged within 30 additional days.

Secure development

• Code review on all commits to main
• Dependabot + GitHub secret scanning + CodeQL static analysis
• No production credentials in source code
• Environment secrets managed via Supabase Vault and Vercel Environment Variables (encrypted at rest)
• Deployment is automated and logged

Incident response

• Breach notification SLA: within 72 hours of becoming aware of a Personal Data Breach (GDPR Art. 33), we notify affected Tenant admins by email.
• Incident response plan documented in our internal runbook (available on request under NDA).
• Responsible disclosure: email [email protected] with "Security" in the subject. We acknowledge within 5 business days.

Status page

Real-time uptime and incident history: https://koolay.com/status
Target availability: 99.5% monthly.

Internal policies

Available on request under NDA. We maintain 11 internal policies:

1. Information Security Policy
2. Access Control
3. Data Classification
4. Incident Response
5. Business Continuity & DR (RTO 4h / RPO 1h)
6. Vendor Management
7. Data Retention & Deletion
8. Security Awareness Training
9. Backup & Recovery
10. Change Management
11. Auth Hardening runbook