Security

How we protect your work

Security is built into the architecture, not bolted on. Every credit transaction, every API call, every generation is protected by design.

Authentication & authorization

Clerk-managed auth with industry-standard session management
Every API endpoint verifies auth + ownership (no IDOR)
Admin routes require explicit admin role check
KAGE native client routes enforce HMAC signature verification

Credit & financial safety

Reserve-settle pattern: credits held before work, charged only on success
Idempotent grant operations prevent double-credit exploits
Server-side caps enforce maximum purchase and generation limits
Pricing Guardian monitors margins daily, adjusts rates automatically

Data protection

PostgreSQL with encrypted connections (TLS)
No secrets in client bundles, logs, or URLs
API keys scoped per-user with rate limiting
GDPR-compliant: minimal data collection, clear retention policy

Infrastructure

Deployed on Vercel (SOC 2 Type II certified)
Database on Neon (encrypted at rest and in transit)
No third-party ad trackers or cross-site tracking
Middleware enforces CSP headers on sensitive routes

On-chain transparency

Daily activity batch logged to Base mainnet (immutable)
Smart contract verified and public on Basescan
Platform metrics independently auditable by anyone
No fake numbers possible — blockchain is the source of truth

Responsible disclosure

Found a vulnerability? We want to hear about it. Report security issues to security@katama.ai. We aim to acknowledge reports within 48 hours and will work with you on coordinated disclosure.

In scope: katama.ai, api.katama.ai, *.katama.ai

Out of scope: Third-party services we integrate with (Clerk, Stripe, Vercel, AI providers)