Security Policy

1. Data Location

Kumry is hosted on infrastructure we operate in Australia. Your data is stored there, in our database, file storage and backups. Suggested categorisation also runs there.

A small number of service providers receive limited information and may handle it outside Australia, such as our payment provider. Our sub-processors list at /legal/subprocessors says what each receives and where. We handle those disclosures as described in our Privacy Policy, consistent with the Australian Privacy Principles.

2. Encryption and Secrets

Data in transit between your browser and the Service is encrypted using TLS. Connections to third-party services, such as Xero, QuickBooks Online and our payment provider, also use encrypted transport.

Secrets such as integration credentials and signing keys are held in a dedicated secrets-management system rather than in application code.

3. Access Controls

Access to customer data is restricted to authorised personnel who need it to operate and support the Service. We follow the principle of least privilege: access is limited to what is required for the task.

Our policy requires multi-factor authentication for administrative access to the platform. Within the Service, each organisation's data is kept separate from other organisations' data, and role-based permissions control what each user can see and do. Defined administrative and security events are logged for review.

4. Monitoring and Logging

We monitor system health and security events, and automated alerts flag unusual activity for review.

Logs are used to detect potential security incidents, identify unusual access patterns, and support investigation when needed. Retention periods vary by log type.

5. Incident Response

We maintain an incident response process to contain, investigate, and remediate security incidents.

If an incident is an eligible data breach under the Notifiable Data Breaches scheme in the Privacy Act 1988 (Cth), we will notify affected individuals and the Office of the Australian Information Commissioner as that scheme requires. Affected customers will be told the nature of the incident, the data affected, the actions we have taken, and any steps we recommend they take.

6. Business Continuity

The Service runs on redundant infrastructure, including a replicated database cluster, so that the failure of a single server does not by itself take the Service offline or lose committed data.

Backups are taken daily and kept for 35 days. Restoring from them is tested.

7. Personnel Security

Anyone given access to customer data is bound by confidentiality obligations and receives only the access required for their role. Access is removed when it is no longer needed.

8. Responsible Disclosure

We welcome security researchers who identify vulnerabilities in our platform. If you discover a security issue, please report it to support@kumry.com. We ask that you provide us with reasonable time to investigate and address the issue before making any public disclosure.

We aim to acknowledge reports promptly and to keep you informed of our progress toward resolution. We will not take legal action against researchers who follow responsible disclosure practices and act in good faith.