TRUST CENTER
Security Overview
Last updated 5 November 2026
How Kasplo protects access to the platform, handles customer data and prepares for service recovery. This overview summarises the controls described in our Data Processing Addendum and customer agreements.
1 Hosting and infrastructure
Kasplo’s core application is hosted on AWS in India. Hosting, backups and authorised access follow the location commitments in the DPA and your accepted agreement.
Service providers, integrations and communication delivery may involve processing in other countries. The Subprocessor List identifies relevant providers, purposes and processing locations.
2 Access and customer separation
Staff access to production is approved, limited to work that requires it and periodically reviewed. Privileged production access uses multi-factor authentication. Access is removed when no longer needed, and authorised personnel are subject to confidentiality duties.
Logical separation and authorisation checks apply to application, API, job and export access. Customer administrators remain responsible for their authorised users and available permission settings.
3 Encryption and data handling
Public application, API and administrative connections use TLS/HTTPS. Encrypted messaging transport is used where supported and appropriate, subject to mandatory or expressly agreed requirements. Recipient mail servers and carriers form part of the delivery path.
Backups containing Customer Personal Data are encrypted. Some customer-database storage is not encrypted at rest. The applicable encryption scope is described in Schedule 2 of the DPA and can be discussed during security review.
Access to keys and secrets is restricted. Credentials are handled securely, and unnecessary secrets should not be included in support records.
4 Network protection and changes
Production network access is restricted through firewalls or equivalent controls, with administrative functions separated as described in the DPA. Changes and vulnerability remediation follow controlled, risk-based processes.
Relevant access and security-event records are protected against unauthorised access or alteration. Alert review and log retention follow operational needs and applicable legal duties.
5 Backups and recovery
Protected backups, documented recovery procedures and periodic restoration testing support service recovery. Backup access is restricted.
Recovery arrangements depend on the service and agreed scope. Specific recovery-time, recovery-point or availability guarantees apply only where expressly agreed. See the Terms of Service and Support Policy for the standard service framework.
6 Security review and incident handling
Kasplo carries out periodic vulnerability and security assessments, with remediation prioritised according to risk. Incident procedures cover investigation, containment, escalation, mitigation and relevant evidence preservation.
The DPA governs notifications of Security Incidents affecting Customer Personal Data, including notification without undue delay after awareness and follow-up as information becomes available. Each party remains responsible for reports it is independently required to make.
7 Privacy and service providers
Customer Personal Data is processed for the agreed services and documented lawful instructions, subject to the DPA. Personnel and service-provider access is limited to the permitted work.
The Privacy Policy explains Kasplo’s own handling of personal information. The GDPR & Data Protection overview explains processing roles, individual rights requests and international-transfer arrangements. Subprocessor authorisation and oversight follow the DPA and maintained Subprocessor List.
8 Security questions and documents
For security questions, questionnaires or information about applicable controls and available supporting documentation, contact support@kasplo.com. Relevant reports may be shared under appropriate confidentiality arrangements, subject to the DPA and applicable rights.
To report a suspected security issue, describe the affected service, timing and observed impact. Do not send passwords, full API keys, SMTP credentials or unnecessary personal information. Urgent production incidents should follow the Support Policy.
Data Processing Addendum — security measures, incidents, assistance and processing commitments.
Subprocessor List — relevant service providers and processing locations.
Privacy Policy — Kasplo’s handling of personal information.
This overview does not amend your agreement or promise controls beyond its stated scope. Service-specific requirements and additional commitments must be expressly agreed.