Security — Kilo

At a glance

The 15-second version.

We never see or store your card number. Stripe does — and they're PCI-DSS Level 1 certified.
Your data is encrypted in transit and at rest. TLS 1.2+ on every connection; AES-256 on every stored record.
You can lock the app with Face ID, Touch ID, or a 6-digit PIN.
We never sell your data. No ad networks, no data brokers, no exceptions.
You can delete your account any time, from inside the app, in one tap.

No product is ever "100% secure" — and we won't tell you otherwise. What we will do is document what we actually do, name the vendors we rely on, and tell you when we're not there yet.

Section 1

How your money is protected.

In short: Kilo never handles raw card data. Stripe does — a PCI-DSS Level 1 processor. You keep your bank's zero-liability protections on every charge.

Stripe handles every card transaction

Kilo never sees or stores your full card number. Card details go from your device directly to Stripe over TLS, using Stripe's SDK. The full PAN never reaches our servers.
PCI-DSS Level 1 — Stripe is certified at the highest compliance level for card processors, audited annually by a qualified security assessor.
Tokenization. Stripe returns an opaque token that Kilo stores as the reference to your card. For display only, we keep the brand (e.g., "Visa"), the last 4 digits, and the expiry month/year. We never see or store the full PAN or CVV.
TLS 1.2+ is enforced on every payment-related connection, with modern cipher suites and HSTS at the browser edge.

Apple Pay & Google Pay

Where supported, we accept Apple Pay and Google Pay. These use device-bound tokens — a DAN (Device Account Number) that is unique to your device, not your real card number, and is authorized per-transaction with Face ID, Touch ID, or your device PIN. Kilo sees only the tokenized transaction.

Strong Customer Authentication

For users in the EU, UK, and other regions that require it, Stripe applies 3-D Secure 2 / SCA (Strong Customer Authentication) where the card network requires it. You'll see a challenge from your bank before a charge completes on qualifying transactions.

Fraud screening

Stripe Radar — every transaction is scored by Stripe's machine-learning fraud system. High-risk charges are declined or flagged for review.
Explicit authorization. One-off charges require an authorization in-app before they run. Recurring charges are governed by the rules of the underlying card network and your mandate history with Stripe.
Network-level protection. Your bank's zero-liability protection for unauthorized charges still applies to anything paid with your card through Kilo — reach out to your card issuer in addition to us if that happens.

If you see an unauthorized charge

Open the transaction in Kilo and tap Report issue, or email support@getkilo.app.
Separately, contact your card issuer (the number on the back of your card) and request a chargeback.
We'll coordinate with Stripe to investigate; most disputed charges are resolved within 7–14 business days.

Kilo is not a bank. Kilo is a technology platform. Underlying money movement is handled by Stripe, and funds in transit are covered by Stripe's safeguards — not by the FDIC. We don't hold your money; we route it. If you want the specifics, see §7 of the Terms of Service.

Section 2

How your data is protected.

In short: Encrypted on the wire, encrypted on disk, and tightly scoped internally. Your phone contacts are hashed on-device before they ever leave your phone.

Encryption

In transit. TLS 1.2+ on every connection, enforced via HTTPS-only endpoints and HSTS. The Kilo mobile app uses certificate pinning so even a compromised network can't sit between you and us.
At rest. AES-256 encryption across Firebase Firestore and Firebase Storage, with keys managed by Google. [PLACEHOLDER: add CMEK note if you use Customer-Managed Encryption Keys.]
Passwords. Stored as salted hashes by Firebase Authentication (modified scrypt with per-user salt plus a server-side pepper). We never see, store, or transmit your password in plain text — if you forget it, we reset it, not recover it.
Contacts. When you grant contacts access to find friends on Kilo, phone numbers are SHA-256 hashed on your device before being sent to us. We receive and store only the hashes, not your actual contact list.
Device secrets. Auth tokens, refresh tokens, and biometric-protected flags are stored in the iOS Keychain and Android Keystore via expo-secure-store. They never land in plain files, local storage, or app preferences.

Access controls

Least privilege. Production data access is scoped to a small on-call team and is granted per-role, not per-person.
Two-factor authentication is required on every internal account that can reach production — hardware-backed where available.
Audit logs. Every administrative action against production is logged to an append-only audit trail.
Onboarding / offboarding. Access is provisioned on day one through a checklist that includes background-verified identity; when someone leaves, credentials, SSH keys, and cloud permissions are revoked the same day.
No standing access to user financial data. Employees cannot browse user splits, balances, or card metadata outside of an active support case.

Infrastructure

Google Cloud & Firebase. Our backend runs on Google's infrastructure, which is independently certified for SOC 1, SOC 2, SOC 3, ISO 27001, ISO 27017, ISO 27018, and HIPAA, among others.
Regional redundancy. Firestore replicates every document across multiple zones in our primary region ([us-central1]) for durability and automatic failover.
Daily encrypted backups, retained for [30] days, with disaster-recovery restores tested at least annually.
Environment isolation. Separate Firebase projects for development, staging, and production — no shared databases, no shared credentials.
Edge protection. Google's global load balancers provide DDoS mitigation and TLS termination in front of every public endpoint.

Section 3

Account security.

In short: A few settings in the Kilo app do most of the work. Biometric lock, strong password, verified email.

Sign-in options

Email and password with a minimum of 8 characters, including a mix of letters and numbers. Passwords are checked against known breached-password corpuses at sign-up and blocked if compromised.
Sign in with Apple — passwordless option that lets Apple handle identity. Kilo only receives a verified identity token.
Email verification is required before you can send or receive money on Kilo.
Phone verification is required for finding friends by phone number and for certain high-risk actions.

Extra protection for your device

Biometric unlock. Face ID, Touch ID, or Android fingerprint, via expo-local-authentication. Biometric data never leaves your device — Kilo only receives a yes/no signal from your OS.
6-digit PIN as a fallback or second layer — Settings → Security.
Sign out everywhere — invalidate every other session in one tap, from Settings → Security.

On our roadmap

Two-factor authentication (SMS & authenticator app) — planned for Q3 2026. Sign in with Apple / Google already provide equivalent protection for those providers.
Active sessions list — see every device currently signed in to your account and revoke individually. Planned for Q3 2026.
New-device login alerts — planned alongside the sessions list.

We'll update this section as each lands — we'd rather say "not yet" than pretend.

Your data, your choice

Delete your account from Settings → Account → Delete account. This is self-serve, takes effect within 30 days, and removes your personal data per the Privacy Policy §8.
Export your data at any time from Settings → Privacy → Download my data. You'll get a JSON archive with your profile, splits, settlements, and activity history.

Section 4

App-level protections.

In short: The Kilo app is hardened beyond the login screen — secure key storage, signed updates, and protections against common mobile attacks.

Secure key storage. Every session token and biometric flag lives in the iOS Keychain or Android Keystore, hardware-backed where the device supports it.
Certificate pinning. The app refuses to connect to our API if the TLS certificate chain has been tampered with — neutralizing a whole class of man-in-the-middle attacks.
App binary integrity. Kilo is distributed exclusively through the Apple App Store and Google Play. Both platforms sign and verify every release; sideloaded or modified builds will not pass signature checks.
Signed over-the-air updates. Minor updates ship through Expo EAS Update, which cryptographically signs every update bundle. The app refuses to run an unsigned payload.
Deep-link validation. All kilo://, Universal Link (iOS), and App Link (Android) URLs are validated server-side before the app takes action — so a malicious link can't silently trigger an in-app transfer.
Jailbreak / root detection. [PLACEHOLDER: "The app detects common jailbreak / root indicators and warns you when it runs on a compromised device." — keep this line only if you actually implement it.]
Auto-lock. [PLACEHOLDER: "The app re-prompts for biometric / PIN after 5 minutes in the background." — keep only if implemented.]
Screenshot protection. [PLACEHOLDER: "Sensitive screens (card details, settlement history) are blanked in the app-switcher preview on iOS and block screenshots on Android." — keep only if implemented.]

Section 5

Fraud prevention.

In short: Layered defenses at the payment, account, and behavior levels.

Stripe Radar scores every payment in real time using a model trained across billions of transactions. High-risk charges are declined automatically.
Device fingerprinting. A hashed fingerprint of the device (no personal identifiers) lets us detect account-takeover attempts from new hardware.
Velocity limits. Rate limits on sensitive actions — sending invites, adding payment methods, creating accounts, initiating transfers — cap automated abuse before it reaches users.
Cooling-off on new payment methods. Cards added in the last [24] hours are held to tighter transaction limits until verified; large transfers may require a step-up authentication challenge.
Anomaly detection. Unusual patterns — logins from new countries, rapid creation of high-value splits, failed-then-successful card authorizations — trigger additional verification or manual review.
Step-up verification for high-risk actions: changing your payout destination, adding a second phone number, or approving an unusually large settlement.
Account suspension. Accounts that show clear signs of fraud — bot-driven signups, stolen-card use, coordinated abuse — are blocked and reviewed.

Section 6

Privacy protections.

In short: No selling, no ad networks, your contacts stay yours.

We never sell your data. Not to advertisers, not to data brokers, not for "improving partner experiences."
No third-party ad tracking. No Facebook Pixel, no Google Ads conversion tags, no third-party ad SDKs in the Kilo app.
Contacts are hashed before leaving your device (SHA-256). We never receive your actual contact list.
You control your notifications — push, email, and in-app preferences are separate and individually toggleable.
You can export or delete everything in a single tap, as described in §3.

Full rights, legal bases, and data-subject request processes are documented in the Privacy Policy.

Section 7

Third-party security.

In short: We're honest about what we build and what we trust to providers with stronger security teams than ours. Here's the list.

Vendor	Role	Certifications & references
Stripe	Payments processing, card tokenization, Radar fraud screening	PCI-DSS Level 1 · SOC 1 & 2 · ISO 27001 · privacy center
Google Firebase / Cloud	Authentication, Firestore database, Cloud Storage, Cloud Functions, FCM push	SOC 1 / 2 / 3 · ISO 27001 / 27017 / 27018 · HIPAA · EU-U.S. DPF
Apple	Sign in with Apple, Apple Push Notification service, iOS Keychain	Platform security — Apple-controlled
Google	Android Keystore, Google Play distribution	Platform security — Google-controlled
Expo / EAS	Mobile build pipeline, signed OTA updates, push relay	SOC 2 Type II
Sentry	Crash reporting & error monitoring (scrubbed of PII)	SOC 2 Type II · ISO 27001 · HIPAA · GDPR
[PLACEHOLDER email vendor e.g. Postmark]	Transactional email (verification codes, receipts, security alerts)	[PLACEHOLDER certifications]

For a full list of every processor that touches user data — including location and purpose — see the subprocessors list.

Section 8

Engineering practices.

In short: Peer-reviewed code, scanned dependencies, isolated environments, and humans trained to care.

Mandatory code review — every change to the backend or client is reviewed by at least one other engineer before merging.
Automated tests — unit, integration, and end-to-end tests run on every pull request.
Dependency scanning with GitHub Dependabot and automated vulnerability alerts. High-severity CVEs are patched within [7] days.
Static analysis (SAST) runs on every pull request; findings block merges.
Secret scanning in CI and in pre-commit hooks — credentials accidentally committed are detected before they reach a shared branch.
Branch protection on our main branch — no direct pushes, required reviews, required status checks.
Environment isolation. Development, staging, and production are separate Firebase projects with separate credentials. Staging never contains real user data.
Infrastructure-as-code. Cloud Functions, Firestore security rules, and Cloud Run configuration live in version control; production changes go through the same review process as application code.
Security awareness training at onboarding and annually for every employee and contractor.
Background checks [PLACEHOLDER: "are performed on every new hire where local law permits." — keep only if true].
Independent penetration testing. [PLACEHOLDER: "We engage [FIRM] to conduct a third-party application penetration test annually. A summary is available under NDA to enterprise customers." — keep only if true.]

Section 9

Compliance & certifications.

In short: We map to major privacy regimes and inherit compliance from our core providers. We don't yet hold independent certifications — here's our honest status.

GDPR & UK GDPR. We operate in line with GDPR's principles — lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability. See the Privacy Policy for legal bases and your rights.
CCPA / CPRA. California residents have specific rights around their personal information; we honor verifiable consumer requests through Settings → Privacy and at privacy@getkilo.app. See the Privacy Policy §10.
Apple App Privacy labels. Our App Store privacy labels match the data collection documented in the Privacy Policy.
Google Play Data Safety. Our Play Store Data Safety disclosures match the data collection documented in the Privacy Policy.
PCI-DSS. Because Kilo never stores, processes, or transmits full card data, our integration follows Stripe's SAQ-A eligibility pattern — scope is limited to receiving the token. Stripe holds PCI-DSS Level 1 certification.
SOC 2. [PLACEHOLDER: "Not yet. We plan to complete a SOC 2 Type I audit in [YEAR] and pursue Type II after." — only list SOC 2 status you actually have. Overclaiming here is a federal offense.]
ISO 27001. Not yet. We inherit the ISO 27001, 27017, and 27018 certifications of our underlying Google Cloud infrastructure.

We don't handle protected health information (no HIPAA), children's data (no COPPA — Kilo is 16+), or education records (no FERPA). Those frameworks don't apply to us, so we won't pretend otherwise.

Section 10

Incident response & breach notification.

In short: 24/7 on-call, a written playbook, and a 72-hour breach-notification commitment.

24/7 on-call engineering. A rotating on-call engineer is paged automatically when critical services or error rates breach defined thresholds.
Incident response playbook. We maintain a written, internally published IR plan covering triage, containment, eradication, recovery, and communication. The plan is reviewed at least annually.
Post-incident reviews. Every material incident triggers a blameless post-mortem with documented root cause and concrete remediation actions tracked to completion.
Breach notification within 72 hours. If an incident results in unauthorized access to personal data, we will notify affected users and applicable regulators without undue delay — within 72 hours, meeting GDPR Article 33 requirements.
Status page. Live service health at [status.getkilo.app] (PLACEHOLDER until launched).
Public post-mortems. We commit to publishing post-mortems for any incident that materially affected users, within 30 days of resolution.

Section 11

Responsible disclosure.

In short: Find a bug, tell us first, and we'll work with you. We won't sue good-faith researchers. We publish a security.txt.

How to report

Email security@getkilo.app with a description, reproduction steps, and any relevant screenshots, logs, or proof-of-concept. PGP key: [kilo-security.asc].

Response time: we acknowledge every report within 3 business days and keep you updated through triage, fix, and deploy.

We publish an /.well-known/security.txt file per RFC 9116 so researchers can find our security contact through standard tooling.

In scope

The Kilo iOS and Android apps (latest store release)
Our web properties on *.kilo.app and *.getkilo.app
Kilo Cloud Functions and Firestore security rules

Out of scope

Social engineering of Kilo employees, customers, or vendors
Denial-of-service attacks, volumetric testing, or any attempt to disrupt service for other users
Physical attacks against our offices or employees
Issues that require physical access to an unlocked user device
Findings in third-party services (Stripe, Firebase, Expo, etc.) — please report those directly to the vendor
Best-practice reports with no demonstrable security impact (missing headers, lack of rate-limits with no exploit, etc.)

Rules of engagement

Test only against your own account or a test account you created
Stop immediately and notify us if you encounter another user's data
Don't modify, exfiltrate, or destroy data that isn't yours
Don't publicly disclose until we've had a reasonable chance to fix — typically 90 days, coordinated with you
Don't degrade service for other users in the course of your research

Safe harbor

If you make a good-faith effort to comply with this policy during your security research, we will consider your research authorized, we will work with you to understand and resolve the issue quickly, and we will not pursue or support legal action against you. If legal action is initiated by a third party against you in connection with your research under this policy, we will make this authorization known.

Recognition

[PLACEHOLDER: "We maintain a researcher hall-of-fame at kilo.app/security/hall-of-fame (with your permission), and we're planning a formal bounty program for launch in [QUARTER YEAR]." — keep only what's true.]

Section 12

Phishing & scam awareness.

In short: A few rules you can count on. If a message doesn't match them, it's not from us.

Kilo will never ask for your password, your full card number, your CVV, or your Social Security / national ID number. Not by email. Not by text. Not by DM.
Kilo will never ask you to send money outside the app to "verify" your account, "unlock" a transfer, or "protect" your funds.
Kilo will never ask for your 2FA or verification code. Codes we send you are for you only — anyone asking you to share one is trying to steal your account.
Check the sender. Legitimate Kilo email comes from an @getkilo.app address. Lookalike domains (e.g., getkil0.app, kilo-app.co) are not us.
Hover before you click. Kilo links in email point to kilo.app, getkilo.app, or help.getkilo.app. Other domains are not ours.

Got something suspicious? Forward it to security@getkilo.app. Don't click, don't reply, don't share codes.

Section 13

Subprocessors.

In short: A live list of every vendor that processes user data — role, location, and data types. Updated when we add or change one.

The full subprocessors list is maintained at [privacy.html#subprocessors]. Under our Data Processing Addenda with business customers, we commit to notifying you of changes to this list before new subprocessors go live.

If you need this page broken out to its own URL (e.g., kilo.app/subprocessors) for a vendor-review checklist, contact privacy@getkilo.app.

Section 14

Contact.

In short: Security issues → security@getkilo.app. Privacy → privacy@getkilo.app. Everything else → support@getkilo.app.

Security team
Email: security@getkilo.app · Response within 3 business days
PGP key: kilo-security.asc

Privacy rights
Email: privacy@getkilo.app · Response within 30 days (GDPR / CCPA)

General support
Email: support@getkilo.app · Response within 1 business day

Postal address (for legal notices)
Kilo, Inc.
[PLACEHOLDER: street address]
[PLACEHOLDER: city, state, postal code, country]

We read every email to security@getkilo.app, even if you're not sure what you found is a real issue. If you need an acknowledgment for disclosure coordination, please say so in your email.