Security

Infrastructure

Kelsy is hosted entirely on Amazon Web Services (AWS) in the Asia Pacific (Sydney) region (ap-southeast-2), ensuring data residency within Australia. Our infrastructure includes:

• DynamoDB for database storage with encryption at rest
• S3 for document storage with AES-256 server-side encryption
• CloudFront CDN with TLS 1.3 for content delivery
• Lambda and Step Functions for serverless compute (no persistent servers)
• WAF (Web Application Firewall) for traffic filtering and DDoS protection

Authentication and Access

• Authentication via AWS Cognito with bcrypt password hashing
• Support for Multi-Factor Authentication (MFA) via TOTP
• Social login via Google and Microsoft (OAuth 2.0 / OIDC)
• JWT-based sessions with short-lived access tokens and secure refresh tokens
• Role-based access control (RBAC) with 8 workspace roles
• Automatic session timeout after 8 hours of inactivity
• Account lockout after repeated failed login attempts

Data Encryption

• At rest: All data encrypted with AES-256 using AWS-managed keys (SSE-S3/SSE-KMS)
• In transit: All connections encrypted with TLS 1.3 (minimum TLS 1.2)
• Document storage: Pre-signed URLs with 4-hour expiry for secure access
• Secrets: Managed via AWS Secrets Manager and SSM Parameter Store

Application Security

• CSRF protection on all state-changing API requests (Origin header validation)
• Input validation and parameterised queries (no SQL/NoSQL injection)
• Content Security Policy (CSP) headers
• Rate limiting on authentication and API endpoints
• Automated dependency vulnerability scanning
• Server-side request validation with Zod schemas

Workspace Isolation

Each workspace (RTO) is a fully isolated tenant. Data access is enforced at the query level — users can only access resources within their own workspace. Cross-workspace data access is technically impossible by design.

Validator Network Security

• Separate Cognito user pool for validators (complete pool isolation from RTO users)
• Contact detail filtering in all messaging (blocks emails, phone numbers, URLs)
• Time-limited document access via pre-signed URLs (4-hour expiry)
• Payment escrow via Stripe (funds held until engagement completion)
• Immutable message and report storage for audit compliance

Risk Detection

Kelsy includes an automated risk engine that monitors:

• Unusual login patterns (new IPs, impossible travel)
• Abnormal generation volume (cost anomaly detection)
• Credential compromise indicators
• Concurrent session anomalies

Platform administrators receive real-time alerts for high-risk events and can suspend accounts pending investigation.

Compliance

• Australian Privacy Act 1988 (Cth) and Australian Privacy Principles (APPs)
• Data residency: all data stored within Australia (AWS Sydney region)
• 7-year retention for compliance and regulatory records (ASQA requirements)
• Right to data deletion with 14-day cooling-off period

Incident Response

In the event of a security incident:

• Affected users will be notified within 72 hours of confirmed breach
• We will report eligible data breaches to the OAIC as required by the Notifiable Data Breaches scheme
• Incident post-mortems are conducted with remediation plans

Reporting Vulnerabilities

If you discover a security vulnerability, please report it responsibly:

Email: security@kelsy.com.au

We commit to acknowledging reports within 48 hours and providing a resolution timeline within 5 business days.