Security at Keanan

Keanan holds the working records of real companies: contracts, payroll amounts, receipts and personal details. Protecting that data is a design requirement, not a feature.

Platform security

• Encryption in transit. All traffic between apps, dashboard and API is encrypted with TLS. Hosted deployments obtain and renew certificates automatically.
• Authentication. Sign in uses short lived tokens with rotating refresh tokens and a blacklist on rotation. Login and password endpoints are rate limited.
• Two factor authentication. Any account can require an email code at sign in, enforced across the dashboard and the mobile app.
• Biometric app lock. The employee app supports Face ID and fingerprint lock and relocks when it leaves the foreground.
• Role based access. Admin, manager and employee roles gate every endpoint server side.
• Audit trail. Every mutating administrative action is recorded: who, what, when and which endpoint, with sensitive fields stripped. Workspace exports are admin only and always logged.
• EU hosting. Hosted workspaces run in the AWS Frankfurt region. Self hosted deployments choose their own region and keep full physical control.

Organizational measures

Access to production systems is limited to the people who operate them, authenticated with individual credentials. Workspace exports give every customer a complete, restorable backup path that is independent of us, which we consider part of security: no lock in means no hostage data.

Reporting a vulnerability

If you believe you have found a security issue in Keanan, we want to hear from you at security@keanan.app. Please include enough detail to reproduce the issue.

• We confirm receipt within two business days.
• We will not take legal action against good faith research that stays within the rules below.
• Do not access data that is not yours, degrade the service, or test against customer workspaces. Use a local deployment; the documentation shows how to run one.
• Give us 90 days to fix an issue before public disclosure.

Machine readable details are published at /.well-known/security.txt.