Security
This page says what we actually do to protect your data, in the same plain language as our privacy policy. It is written by the person who built the system, and every line describes something that is in place today. Where something is a limit rather than a strength, it says so.
1. The short version
Kepla collects the minimum, encrypts everything in transit and at rest, keeps production access to one person behind multi-factor authentication, deletes data on a written schedule, and runs the browser tools entirely on your device so there is nothing of yours to protect on our side. We are a one-person company and we say that plainly rather than pretending to have a security team.
2. The tools that never upload
The RAW converters, the HEIC converter, the metadata and GPS removers, the EXIF viewer, the resizer, the text-behind-photo editor and the calculators run inside your browser. Your files are read by JavaScript on your machine and never sent anywhere; what we record is that a tool was used and, when files go through it, how many and their total size, never a filename or a byte of image data. This is enforced, not promised: the site's content security policy restricts where those pages are allowed to send data, and you can check it by turning off your wifi after the page loads and using the tool anyway.
3. The file transfer
Kepla File Transfer is the one service that uploads, by design, because its job is delivery. Your browser packs the files into a single ZIP and uploads it over TLS directly to a private storage bucket at Backblaze; the file bytes never pass through our application servers and nobody at Kepla opens them. Downloads use a signed link created per request that is never valid for longer than the transfer has left to live, at most 3 days. When the transfer expires, a scheduled job deletes the files within 24 hours, and the storage bucket has its own rule that deletes anything older than 6 days as a backstop. There is no recycle bin.
What we keep about a transfer, and for how long, is in the privacy policy, section 8. Content reports on a transfer are reviewed within 24 hours and can place it on hold automatically.
4. Encryption
All traffic uses HTTPS with HSTS, so a browser will not connect to us without it. Our database provider (Neon) and our storage provider (Backblaze) encrypt data at rest. Secrets such as API keys live only in our hosting provider's environment configuration, never in code, never in a URL.
5. Who can see your data
Production access is held by the founder alone, on accounts protected by multi-factor authentication, with one scoped key per job. There are no shared logins and no standing access for anyone else, including the AI tools used during development. Administrative endpoints require a key that is sent only in a request header, compared in constant time, and they refuse to open at all if that key is not configured.
6. Hardening you cannot see
Every page carries security headers: a content security policy that allows scripts only from this site, anti-clickjacking, MIME-sniffing protection, a strict referrer policy and a permissions policy. Every form has rate limits and a honeypot. Database queries are parameterised, every input is length-capped and validated, and exports neutralise spreadsheet formula injection. IP addresses are used only transiently for rate limiting; where an abuse marker has to be stored it is a truncated keyed hash that cannot be turned back into the address without a secret held only in our server configuration. No third-party scripts run on this site; the analytics is first-party and uses no cookies.
7. Logging and monitoring
Meaningful events (a transfer created, opened or reported, a booking request, an error) are written to an application log that the founder reviews weekly, and our providers keep their own audit logs of logins and configuration changes. Raw IP addresses and secrets are never written to any log.
8. Backups and recovery
The database has point-in-time recovery plus a monthly encrypted copy, and we test a restore twice a year. The site and its functions are in version control with instant rollback to any previous deployment. Transfer files are intentionally not backed up: they exist to be delivered and deleted, and a lost file means the sender sends again.
9. If something goes wrong
We keep a written incident plan. For anything that could have exposed personal data, the affected credential is rotated within the hour, affected people are told by email in plain language, and any authority the law requires is notified without undue delay and within 72 hours where GDPR applies. Every incident gets a written post-incident note.
10. Reporting a security problem
If you find a vulnerability, email support@getkepla.com with what you found and how to reproduce it. You will get a reply from the founder within two working days, a fix on a timeline that matches the severity, and our thanks. Please do not access other people's data or disrupt the service while testing.
11. Sub-processors and where data lives
Vercel (hosting), Neon (database), Backblaze (transfer storage), Resend (email), and GitHub (source) each hold their own SOC 2 Type II reports; OpenAI and Google process demo text only; Meta is involved only if you connect Instagram. All processing is in the United States. The closed list, with what each one touches, is in the privacy policy, section 6.
12. What we do not have yet
Kepla does not hold its own SOC 2 report or a third-party penetration test. We run a written security program mapped to the SOC 2 Common Criteria, keep an evidence log, and will engage an auditor when a customer's contract requires it. We do not handle payment card data: nothing on the site takes a card today. When that changes, this page will change first.
13. Contact
support@getkepla.com for security questions, questionnaires, or a copy of our controls summary.