Security and data

One database per customer

Every kikstart customer has their own Postgres database. There is no shared table with a customer column; isolation is at the connection, not the row. The platform maps your store to your database and nothing else can reach it.

Row-level security inside it

Inside your database, every role is enforced by Postgres row-level security. Staff, managers and shoppers each see the rows their role permits, and the assistant acts through the same policies as the person asking. Authorization is enforced by the database, not by the user interface.

Three layers of authentication

A signed-in route gate, a server-side session check on every action, and the database policies underneath. A request has to pass all three.

Secrets

Your gateway and storage credentials are sealed per customer and are not readable by the shared runtime. On dedicated plans they live in your own deployment's protected environment.

Payments

Card data never touches kikstart. PayFast and Stripe handle it end to end; we hold references, not numbers.

Where data lives

Databases run on Neon, the application on Vercel. Regions are chosen for latency to South Africa and can be set per customer on dedicated plans.

POPIA

kikstart is built for South African businesses and processes personal information under the Protection of Personal Information Act. Each customer is the responsible party for their own data; kikstart is the operator. A processing agreement is available on request.

Reporting a vulnerability

Email security@kikstart.ai. We acknowledge within two business days.