Security Overview

Security is built into how Kool is designed and run. This overview summarizes our protections; report vulnerabilities to security@k00l.app.

Hosting & encryption

Kool runs entirely on Cloudflare (Workers, D1 database, R2 storage, Durable Objects, Workers AI, and Realtime + TURN for calls/live), fronted by Cloudflare's WAF and DDoS protection. All traffic is encrypted with TLS; data is encrypted at rest; calls and live use encrypted WebRTC.

Authentication

Sign-in is passwordless, so there are no user passwords to steal. One-time codes are stored only as short-lived hashes. Optional authenticator-app 2FA with hashed recovery codes, rotating hash-only session tokens, and device-session revocation protect your account. Sensitive actions are rate-limited.

Data protection

Every user's data is isolated by row-level tenancy, admin access is least-privilege and 2FA-gated, and secrets are stored as platform bindings, never in code. We log abuse signals and errors for security and reliability, and moderate content automatically with an appeal path.

Secure development

Changes are reviewed, type-checked, and validated in a staging environment before reaching production, on Cloudflare's near-zero-downtime deploy model.

Responsible disclosure

We welcome good-faith research. Please give us time to fix issues before disclosure, avoid privacy violations and disruption, and access only the minimum needed to demonstrate an issue. Contact security@k00l.app.

Compliance

GDPR/CCPA-aligned today; SOC 2 and ISO 27001 are on our roadmap. See the Trust Center.