security
How Koshio approaches security
What this website does today, and the security requirements the Koshio platform is being built to.
today
This website
Hosting
The site runs on Vercel, with its server functions in Mumbai (bom1).
Encrypted connections
Pages are served only over HTTPS, and browsers are told to keep using HTTPS (HSTS).
Security headers
Every response stops other sites from framing these pages, blocks content-type sniffing, limits the referrer it sends and turns off camera, microphone and location access.
The contact form stores nothing
Each enquiry is sent by email to our sales inbox through Google Workspace. The website keeps no copy.
Measurement
Google Analytics counts visits. The details you type into the contact form are never sent to Google.
Synthetic examples
Every person, business, identifier and result shown on this site is synthetic.
by design
Requirements the platform is being built to
The Koshio platform is still being built. These are requirements from our design documents, not a description of a running service.
Each customer is isolated
Requests, results and evidence belong to one customer and one product instance, and every read checks that it does.
Short-lived credentials
API calls carry short-lived tokens issued through OAuth client credentials or mutual TLS, scoped to one customer and environment.
Purpose and consent travel with each request
Every call declares one of its approved purposes, and carries a consent record wherever the source or policy needs one.
Managed secrets and keys
Provider credentials live in a managed secret store, and stored evidence is encrypted with keys we manage in a key service.
Raw Aadhaar numbers are never stored
Document checks mask Aadhaar numbers, and the unmasked number is not retained.
Evidence you can audit
Each result points to the evidence behind it. Evidence is never overwritten; a correction is a new record linked to the old one.
Data location decided per API
The design keeps stores and logs in Mumbai, and where each API’s data may go is confirmed before any real data flows.
Browser signals are never a verdict
Checks that run in a customer’s browser only guide the capture. Results that matter come from evaluated server or provider checks.
assurance
Audits
Koshio holds no security certifications yet. We will list completed audits here, with their scope and date.
disclosure
Report a vulnerability
If you think you have found a security problem in this website or anything else Koshio runs, email sales@koshio.in with the steps to reproduce it. We will confirm we have received it and keep you informed while we fix it.
Please give us reasonable time to fix a problem before telling anyone else. Don't access data that isn't yours, disrupt the service, or run automated scans that could affect other visitors. We don't run a paid bug bounty.
The same contact is published in our security.txt. For how we handle the details you send through the contact form, read the privacy notice.
Questions from your security team?
Bring them to a walkthrough. We'll go through how the platform is designed to handle your customers' data.
Or write to sales@koshio.in