Security

Last updated: 23 October 2026

Security is central to how we build Kuruvi. This page explains the measures we take to protect your data, how we respond to security incidents, and how to report a vulnerability.

1. How we protect your data

• Encryption in transit: all traffic to and from Kuruvi is protected with TLS.
• Encryption at rest: data is encrypted at rest using AES-256 (Google Cloud / Firestore default encryption). Shopify and eBay access tokens are additionally encrypted with Google Cloud KMS; other platform credentials are kept in server-only storage that the app cannot read.
• Authentication: the app's server functions check who is calling, refuse signed-out and revoked sessions, and ask you to sign in again before sensitive actions. The website chat widget is the exception: it lets visitors who are not signed in message a business.
• Firebase Security Rules: Firestore and Storage rules keep each business's conversations, orders and connections to that business and its team. Public profiles (name, username, photo and whether someone is online) and marketplace listings are visible to other signed-in Kuruvi users.
• App integrity: most server functions also require Firebase App Check (reCAPTCHA Enterprise on the web, Play Integrity on Android, App Attest on Apple devices), which helps ensure requests come from genuine instances of the app.
• Rate limiting & abuse prevention: rate limits and quotas guard sensitive and costly endpoints.
• Access records: we record who opened Shopify customer data or rental applications in the app, and the actions Kuruvi administrators take on accounts through our admin tools, with the time and IP address.
• Backups: our database has point-in-time recovery and daily backups.

2. Security incident response

If a security incident happens, this is how we respond:

• Detection & triage: when a potential incident is detected (through monitoring, alerts, or a report), we triage it and begin an initial assessment within 24 hours.
• Containment: we move to contain the issue — for example revoking credentials, isolating affected systems, or disabling affected functionality.
• Investigation: we determine the scope, root cause, and what data (if any) was affected.
• Notification: if a personal-data breach affects personal data we are responsible for, we tell the relevant supervisory authority where the law requires it, within 72 hours of becoming aware of it where feasible, and tell the people affected where the law requires it. Where we hold the data for a business, we tell that business without undue delay so it can meet its own duties. For Shopify-related incidents we also notify Shopify as required.
• Remediation: we fix the root cause and apply safeguards to prevent recurrence.

3. Report a security issue

If you believe you've found a security vulnerability or have a security concern, please contact us at security@kuruvi.com. We aim to acknowledge security reports within 24 hours on business days. Please include enough detail to reproduce the issue, and give us a reasonable opportunity to address it before public disclosure.

4. Related

See our Privacy Policy for how we collect, use, and retain data, and our Data Deletion page to request deletion of your data.