Security
Kaduno is built with security as a foundational property, not an afterthought. This page describes the core mechanisms we have in place to protect your data and your customers' data.
Skip to content
Tenant isolation
Kaduno is a multi-tenant platform. Each company (tenant) is strictly isolated from all others at the data layer — not only at the interface layer. All business data is bound to a company ID and a storefront ID. Cross-tenant data leakage is treated as a P0 bug.
A tenant may have one or more storefronts. Storefront data (catalog, pricing, content) is scoped per storefront. Company data (CRM, finance, inventory, purchasing) is scoped per company. Neither boundary can be bypassed by application code — scoping is enforced in data-layer repositories, not only in API middleware.
Access control and roles
Kaduno uses role-based access control (RBAC) across all API endpoints. Access tiers include:
- **super_admin** — platform-wide access (Kloner staff only) - **admin** — tenant-scoped access - **vendor_admin** — store-scoped access - **operator** — operational staff access - **viewer** — read-only access
All tRPC procedures require an explicit minimum role. When a request crosses a tenant or storefront boundary, `NOT_FOUND` is returned rather than `FORBIDDEN` to avoid leaking existence.
Audit logging
Kaduno logs changes to business entities — creation, update, and deletion — with actor ID, timestamp, and tenant context. Audit logs are tenant-isolated: you can see your own events, not those of other tenants.
Administrators can review the audit log from the admin interface. Logs are designed to answer "who changed what, and when?"
AI governance
K-AI and all embedded AI features in Kaduno follow these principles:
- **AI never owns the source of truth.** AI assistance may suggest, but pricing, stock, orders, and invoices are determined by deterministic logic and human decisions. - **All AI calls are auditable.** Inputs, model ID, token usage, cost, and output are logged per account and per tenant. - **Tenant-isolated context.** One tenant's data never leaks into another tenant's AI call — this applies to embeddings, RAG retrievals, agent requests, and behavioural profiles. - **Consented behavioural data.** Visitor behavioural signals used for personalisation are subject to K-Compliance's consent framework. No silent profiling outside the consent posture.
Integration credential handling
Kaduno connects to external systems (payment gateways, carriers, accounting systems, etc.) via a stored credential registry. Lookup follows this order:
1. Per-store credential in the database 2. Global credential in the database 3. Environment variable fallback
Credentials are never exposed in API responses to clients. Rotation is supported without downtime by updating the stored value. External calls use resilient fetch with timeout and error handling.
Responsible disclosure
We welcome reports of security vulnerabilities. If you discover a potential security issue in Kaduno, we ask that you contact us via the contact form at kaduno.com rather than publishing the information publicly.
We aim to acknowledge receipt within two business days and keep you updated on progress. We do not currently operate a public bug bounty programme, but we appreciate and recognise responsible reports.
Thank you for helping us keep the platform secure.