Overview
At Kintact, we understand that security and privacy are paramount when it comes to your family's emergency contact information. We've implemented multiple layers of security to protect your data while ensuring it remains accessible when you need it most.
This document outlines our security practices, what data we protect, and how you can maximize the security of your family vault.
Data Protection Measures
PIN Authentication High Security
Your 4-digit family PIN is the primary authentication method for accessing your vault. This PIN is never stored in plain text; instead, it is hashed and salted using industry-standard cryptographic methods.
Identity Verification High Security
When managing your family vault (adding/editing members), we require additional verification through security questions based on family relationships. This ensures that even if someone obtains your PIN, they cannot make changes to your vault without knowing personal information about your family.
Data Encryption High Security
All data is encrypted both in transit (using TLS 1.3) and at rest (using AES-256 encryption). This means your information is protected whether it's being sent between your device and our servers or stored in our databases.
Infrastructure Security High Security
We utilize Supabase, which runs on AWS infrastructure with enterprise-grade security measures including DDoS protection, intrusion detection, and regular security audits.
What We Store
Kintact stores only the minimum information necessary to provide our service:
- Family PIN: Hashed and salted, never stored in plain text
- Member Names: First names of family members
- Phone Numbers: For emergency contact purposes
- Email Addresses: Optional field for additional contact methods
- Relationships: How each member is related to the family (Father, Mother, etc.)
- Visibility Settings: Whether each member appears in emergency results
User Security Best Practices
To maximize the security of your family vault, we recommend the following best practices:
PIN Management
- Choose a unique 4-digit PIN that isn't associated with birthdays or common sequences
- Change your PIN periodically (you can do this by creating a new family vault)
- Only share your PIN with immediate family members who need emergency access
- Never write down your PIN in easily accessible places
Device Security
- Use device passcodes or biometric authentication on phones and tablets
- Keep your devices updated with the latest security patches
- Be cautious when accessing Kintact on shared or public devices
- Consider using private browsing mode on devices you don't own
Monitoring and Maintenance
- Regularly review your family member list to ensure accuracy
- Update contact information when phone numbers or emails change
- Remove members who no longer need to be in your emergency contacts
- If you suspect unauthorized access, create a new family vault with a different PIN
Security Vulnerability Reporting
If you discover a security vulnerability in Kintact, we encourage you to report it to us immediately. We are committed to working with security researchers to address vulnerabilities promptly.
Please send vulnerability reports to: kintact@zohomailcloud.ca
Include as much detail as possible, including:
- Steps to reproduce the issue
- Screenshots or videos demonstrating the vulnerability
- Any relevant error messages or logs
- Your suggested remediation (if available)
We aim to respond to all legitimate vulnerability reports within 72 hours and will work diligently to patch verified issues.
Security Update History
Kintact maintains a commitment to continuous security improvement. Below is a record of significant security updates:
Version 1.0.0 (Initial Release)
- Implemented PIN hashing with bcrypt algorithm
- Added multi-layer authentication for management functions
- Enabled end-to-end encryption for all data transmissions
- Implemented visibility controls for emergency contacts