Security & Disclosure

1.1Passwords are stored as salted hashes using bcrypt. We cannot read your password, and neither can anyone who obtains the database.

1.2Sessions use signed tokens rather than storing credentials on your device.

1.3Staff accounts have granular per-role permissions. You can let a cashier create bills without giving them sight of cost prices, margins or reports.

1.4You are responsible for keeping your own credentials and your staff's credentials safe. Most account compromises come from shared or reused passwords, not from breached servers.

2.1Traffic between your device and our servers is encrypted in transit using TLS.

2.2The API applies standard hardening headers, request rate limiting to blunt brute-force and scraping, and an explicit allowlist of permitted origins.

2.3Data is held with the providers named in the Sub-processors document, under their managed security controls.

3.1Your business records are stored so the app can work offline and sync when you reconnect. The local copy is removed when you sign out or uninstall.

3.2We do not sell your data, and we run no advertising or analytics against it.

3.3You can request an export or deletion of your data at any time. See the Privacy Policy.

4.1We would rather be plainly accurate than reassuring. As of this version, Khata does not hold SOC 2, ISO 27001 or any comparable third-party security certification.

4.2We do not currently run a paid bug bounty, and we have not published an independent penetration test.

4.3No system is perfectly secure, and we do not guarantee absolute security. Keep your own records of transactions that matter to your business.

4.4If any of the above changes, it will be published here with a new version rather than announced only in marketing material.

5.1Report suspected vulnerabilities to security@lacspace.com. Include enough detail to reproduce the issue, and give us reasonable time to fix it before publishing.

5.2We will not pursue legal action against good-faith security research that:

• Respects user privacy and does not access, modify or retain other people's data.
• Does not degrade, disrupt or overload the service.
• Does not use social engineering, phishing or physical attacks against our staff or users.
• Gives us a reasonable opportunity to respond before public disclosure.

5.3We aim to acknowledge reports within 5 working days. We do not promise a fixed remediation deadline, because the honest answer depends on the finding.

5.4We are glad to credit researchers who report responsibly, if you would like to be named.

6.1If a breach affects your data, we will notify affected users and any regulator we are required to notify, describing what happened, what data was involved and what to do about it.

6.2We will not delay a notification in order to finish investigating, where delaying would leave you exposed.

7.1Security reports: security@lacspace.com. General privacy questions: privacy@lacspace.com.