---
title: "Security & Disclosure"
source: https://www.lskhata.com/legal/security
version: 1.0
effective: 2026-08-06
updated: 2026-08-06
reference: LSK-LEGAL-SECURITY-V1.0
---

# Security & Disclosure

How Khata protects your account and data, what we do not claim, and how to report a vulnerability safely.

Version 1.0, effective 2026-08-06. Reference LSK-LEGAL-SECURITY-V1.0.

## At a glance

This is a reading aid, not the agreement. The clauses below are.

- Passwords are stored as salted hashes and never in plain text.
- Traffic is encrypted in transit; the API is rate limited and origin restricted.
- Staff logins have granular permissions, so a cashier need not see your margins.
- Report a vulnerability to security@lacspace.com — we will not pursue good-faith research.
- We state plainly what we have not done, rather than implying certifications we do not hold.

## 1. Account Security

1.1 **(important)** Passwords are stored as salted hashes using bcrypt. We cannot read your password, and neither can anyone who obtains the database.

1.2 Sessions use signed tokens rather than storing credentials on your device.

1.3 Staff accounts have granular per-role permissions. You can let a cashier create bills without giving them sight of cost prices, margins or reports.

1.4 **(important)** You are responsible for keeping your own credentials and your staff's credentials safe. Most account compromises come from shared or reused passwords, not from breached servers.

## 2. Infrastructure

2.1 Traffic between your device and our servers is encrypted in transit using TLS.

2.2 The API applies standard hardening headers, request rate limiting to blunt brute-force and scraping, and an explicit allowlist of permitted origins.

2.3 Data is held with the providers named in the Sub-processors document, under their managed security controls.

## 3. Data Handling

3.1 Your business records are stored so the app can work offline and sync when you reconnect. The local copy is removed when you sign out or uninstall.

3.2 **(important)** We do not sell your data, and we run no advertising or analytics against it.

3.3 You can request an export or deletion of your data at any time. See the Privacy Policy.

## 4. What We Do Not Claim

4.1 **(important)** We would rather be plainly accurate than reassuring. As of this version, Khata does not hold SOC 2, ISO 27001 or any comparable third-party security certification.

4.2 We do not currently run a paid bug bounty, and we have not published an independent penetration test.

4.3 **(important)** No system is perfectly secure, and we do not guarantee absolute security. Keep your own records of transactions that matter to your business.

4.4 If any of the above changes, it will be published here with a new version rather than announced only in marketing material.

## 5. Reporting a Vulnerability

5.1 **(important)** Report suspected vulnerabilities to security@lacspace.com. Include enough detail to reproduce the issue, and give us reasonable time to fix it before publishing.

5.2 We will not pursue legal action against good-faith security research that:

  - Respects user privacy and does not access, modify or retain other people's data.
  - Does not degrade, disrupt or overload the service.
  - Does not use social engineering, phishing or physical attacks against our staff or users.
  - Gives us a reasonable opportunity to respond before public disclosure.

5.3 We aim to acknowledge reports within 5 working days. We do not promise a fixed remediation deadline, because the honest answer depends on the finding.

5.4 We are glad to credit researchers who report responsibly, if you would like to be named.

## 6. If Something Goes Wrong

6.1 **(important)** If a breach affects your data, we will notify affected users and any regulator we are required to notify, describing what happened, what data was involved and what to do about it.

6.2 We will not delay a notification in order to finish investigating, where delaying would leave you exposed.

## 7. Contact

7.1 Security reports: security@lacspace.com. General privacy questions: privacy@lacspace.com.