Security at Karinda

Last updated: 3 October 2026

Infrastructure

• Runs on Cloudflare's global network with built-in DDoS protection.
• All traffic is encrypted with HTTPS/TLS; strict transport security and content security policy headers are enabled.

Accounts

• Passwords are stored only as salted PBKDF2-SHA256 hashes.
• Short-lived session tokens that are revoked on sign-out, password change or account suspension; "sign out of all devices" is available.
• Email verification and password reset codes are single-use, expire after 10 minutes and lock after 5 wrong attempts.
• API keys are shown once and stored only as a hash.
• Login, sign-up and lead submission are rate limited.
• Optional two-factor authentication with any authenticator app, plus single-use recovery codes. Authenticator secrets are encrypted at rest (AES-256-GCM).
• Karinda staff accounts require two-factor authentication, have role-based permissions, time out after an hour of inactivity, and every view of customer data is written to an audit log.
• Services are monitored around the clock, with alerts when anything goes down.

Your assistant

• An allowed-domains list makes sure your assistant only runs on your own websites.
• Each business's knowledge base is isolated from other businesses.
• The assistant is instructed to answer only from your content and to resist prompt-injection attempts.
• Visitors are told they are talking to an AI assistant, with a link to the privacy policy.

Your data

• Automatic lead deletion after a retention period you choose.
• One-click data export and permanent account deletion.
• Audit log of security-relevant actions.
• We do not sell data or use your conversations to train AI models.

Report a vulnerability

Email security@karinda.in. We aim to respond within 2 business days.