Security

How we protect data

• All traffic to Kalplex is encrypted with TLS.
• Each business's records are isolated at the database level by row-level security, so one business can never read another's data.
• GoCardless access tokens and webhook secrets are stored in a table no browser session can read, and are used only by our servers.
• Status updates from GoCardless are accepted only after their HMAC signature has been verified with your webhook secret.
• Bank account details never touch Kalplex — payers enter them on GoCardless's secure pages.
• Passwords are handled by our authentication provider and stored only as secure hashes.

What you can do

• Use a strong, unique password and sign out on shared devices.
• Create a separate GoCardless access token for Kalplex so you can revoke it independently.
• Rotate your webhook secret in GoCardless and Kalplex if you think it has been exposed.

Reporting a vulnerability

If you believe you have found a security issue, email support@kalplex.com with details and steps to reproduce it. Please give us reasonable time to fix it before disclosing it publicly, and do not access other people's data while testing.