Security Overview

Security is built into how Kool is designed and run. This overview summarizes our protections; report vulnerabilities to security@k00l.app.

Hosting & encryption

Kool runs entirely on Cloudflare (Workers, D1 database, R2 storage, Durable Objects, Workers AI, and Realtime + TURN for calls/live), fronted by Cloudflare's WAF and DDoS protection. All traffic is encrypted with TLS; data is encrypted at rest; calls and live use encrypted WebRTC.

Authentication

Sign-in is passwordless — there are no user passwords to steal. One-time codes are stored only as short-lived hashes. Optional authenticator-app 2FA with hashed recovery codes, rotating hash-only session tokens, and device-session revocation protect your account. Sensitive actions are rate-limited.

Data protection

Every user's data is isolated by row-level tenancy, admin access is least-privilege and 2FA-gated, and secrets are stored as platform bindings — never in code. We log abuse signals and errors for security and reliability, and moderate content automatically with an appeal path.

Secure development

Changes are reviewed, type-checked, and validated in a staging environment before reaching production, on Cloudflare's near-zero-downtime deploy model.

Responsible disclosure

We welcome good-faith research. Please give us time to fix issues before disclosure, avoid privacy violations and disruption, and access only the minimum needed to demonstrate an issue. Contact security@k00l.app.

Compliance

GDPR/CCPA-aligned today; SOC 2 and ISO 27001 are on our roadmap. See the Trust Center.