About This Overview
This Security Overview summarises Kahunas' security posture, infrastructure, and data-handling practices. It is a summary for customers and prospective customers and does not itself create contractual obligations; the Business User Terms, Data Processing Addendum, Privacy Policy, and related documents govern. Where this overview and those documents differ, those documents govern.
1 Infrastructure & Hosting
| Area | Description |
|---|---|
| Application Hosting | Vercel — serverless edge deployment with automatic scaling, DDoS mitigation, zero-downtime deployments, and global edge delivery. |
| Database Hosting | Neon — serverless PostgreSQL with automated failover, continuous backups, point-in-time recovery (PITR), and isolated compute. Primary database hosted in AWS eu-west-2 (London). |
| File & Media Storage | AWS S3 — encrypted storage for coach and client media, including photos, documents and uploaded files. Object versioning enabled. |
| Video & Media CDN | Bunny.net — secure media hosting and global content delivery. |
| Caching & Queuing | Upstash Redis — encrypted serverless caching and tenant routing. |
| Bot Protection | Cloudflare Turnstile — bot detection and CAPTCHA on sign-in and chat. |
| Primary Data Region | Primary customer data is hosted in AWS eu-west-2 (London, United Kingdom). Certain supporting infrastructure and authorised sub-processors operate from the United States and other regions as described in our Privacy Policy and Sub-Processor List. |
2 Encryption
| Area | Description |
|---|---|
| In Transit | TLS 1.2 or higher across all web, API, webhook and service communications. |
| Database | Managed AES-256 encryption at rest provided by Neon. |
| File Storage | AWS S3 server-side encryption (SSE-S3). |
| Caching | Upstash Redis encrypted at rest. |
| Payments | Payment processing is provided by Stripe and, where enabled by the coach, PayPal. iOS native app subscriptions are processed through Apple's App Store In-App Purchase. Kahunas does not store payment card details. |
3 Identity & Access Management
| Area | Description |
|---|---|
| Authentication | WorkOS provides authentication, SSO, MFA, RBAC and session management. |
| Production Access | Production database access is restricted to authorised engineering personnel only. |
| Administrative Access | Coach Success personnel have scoped administrative access required to support customers. Support staff do not have direct database or infrastructure access. |
| Least Privilege | Access is granted according to role and reviewed regularly. |
| Multi-Factor Authentication | MFA is available through WorkOS but is not currently enforced for all accounts. As a mitigating control, destructive operations — including data deletion — are restricted to admin accounts only. Mandatory MFA enforcement forms part of our security roadmap. |
| Offboarding | User access is revoked across connected systems through WorkOS deprovisioning during employee offboarding. |
4 Data Handling & Privacy
| Area | Description |
|---|---|
| Data Types | Personal information, health and fitness data, workout records, nutrition records, check-ins, messaging, media, and billing metadata. |
| Storage | Structured data is stored in Neon PostgreSQL. Media is stored in AWS S3 and delivered via Bunny.net. |
| Privacy Compliance | Kahunas supports users globally and processes personal data in accordance with applicable privacy laws, including UK GDPR, EU GDPR, UAE Federal Decree-Law No. 45/2021 and other applicable regulations. |
| Controller / Processor Model | Kahunas acts as both Data Controller and Data Processor depending on the processing activity, as described in our Privacy Policy and Data Processing Addendum. Business Users are the sole Controller of Client Personal Data within their Account. |
| Health Data | Health and special-category data is handled in accordance with the Kahunas Health Data Policy, including explicit-consent requirements and exclusion from analytics and telemetry. |
| Data Subject Rights | Users may exercise applicable privacy rights in accordance with the Kahunas Privacy Policy. |
| Retention | Data is retained in accordance with the Kahunas Privacy Policy and Data Retention Policy. |
5 Sub-Processors
Kahunas maintains an up-to-date Sub-Processor List describing all third-party providers that process customer information. The list below is a summary; the Kahunas Sub-Processor List (currently Version 2.6, effective 5 October 2026) is the authoritative register. Where this summary and that list differ, the Sub-Processor List governs.
Core Infrastructure
- Vercel
- Neon
- AWS
- Upstash
- Bunny.net
- Cloudflare (Turnstile)
Identity & Payments
- WorkOS
- Stripe
- PayPal
- Apple (App Store In-App Purchase)
Communications & Support
- SendGrid
- GetStream
- GIPHY
- Gleap
Search
- Typesense
- SerpApi (web search for the AI research agent)
Analytics & Observability
- Vercel Analytics
- Vercel Speed Insights
- Mixpanel
- Databox
- SigNoz
- OpenReplay
AI Services
- Google Gemini
- DeepSeek (served by Baseten)
- OpenAI
- Cartesia (text-to-speech for AI agent voice recaps)
- Vercel AI Gateway
AI providers process user inputs only as necessary to generate requested responses. Health data is not sent to third-party AI providers unless the required user consent has been obtained and appropriate contractual safeguards are in place, as described in the Privacy Policy and Health Data Policy.
6 Backup & Disaster Recovery
| Area | Description |
|---|---|
| Database Backups | Continuous backups and point-in-time recovery provided by Neon. |
| Object Storage | AWS S3 object versioning supports recovery of stored media. |
| Resilience | Infrastructure resilience is provided through managed redundancy across Vercel, Neon and AWS. |
7 Monitoring & Incident Response
| Area | Description |
|---|---|
| Monitoring | Infrastructure monitoring provided through Vercel, AWS and Neon. Application observability is provided through SigNoz and OpenReplay. |
| Incident Response | Security incidents are triaged, contained, investigated, remediated and reviewed under Kahunas' incident response process. |
| Customer Notification | Affected customers are notified where required by applicable law and the Kahunas Privacy Policy. |
8 Frequently Asked Security Questions
Q. Is customer data encrypted? A. Yes. All customer data is encrypted in transit using TLS 1.2+ and encrypted at rest using managed encryption provided by our infrastructure providers.
Q. Do you store payment card information? A. No. Payments are processed by Stripe and, where enabled, PayPal, with iOS native app subscriptions processed through Apple's App Store In-App Purchase. Kahunas does not store payment card details.
Q. Where is customer data hosted? A. Primary customer data is hosted in AWS eu-west-2 (London, United Kingdom). Certain supporting services operate from the United States and other regions as disclosed in our Privacy Policy and Sub-Processor List.
Q. Who can access production systems? A. Access is restricted to authorised personnel according to role-based access controls and the principle of least privilege. Production database access is limited to authorised engineering personnel.
Q. Is multi-factor authentication enforced? A. MFA is available through WorkOS but is not currently enforced across all accounts. As a mitigating control, destructive operations such as data deletion are restricted to admin accounts only. Mandatory MFA enforcement forms part of our security roadmap.
Q. How are AI providers used? A. Kahunas uses Google Gemini, DeepSeek (served by Baseten), and OpenAI (for voice-note transcription), routed via Vercel AI Gateway, to provide AI functionality. Cartesia converts AI agent results into optional voice recaps, and SerpApi runs web searches on coach-entered topics for the AI research agent. AI providers process user inputs only to generate requested responses. Health data is not processed by third-party AI providers unless the required consent and contractual safeguards are in place.
Q. Are you SOC 2 or ISO 27001 certified? A. Kahunas does not currently maintain organisational SOC 2 or ISO 27001 certification. Our infrastructure providers maintain industry-standard security certifications appropriate to their services. Organisational certification remains part of our security roadmap.
Q. Do you perform penetration testing? A. Security reviews are integrated into the software development lifecycle. Independent external penetration testing forms part of our ongoing security programme.
Q. How are departing employees removed from systems? A. Employee access is removed through WorkOS deprovisioning and associated access reviews, revoking access to production systems, administrative tooling and third-party services.
Appendix A — Version History
| Version | Effective Date | Summary of Material Changes |
|---|---|---|
| 1.0 | 17 August 2026 | First publication of the Kahunas Security Overview, aligned with the 17 August 2026 platform document set. Summarises infrastructure and hosting, encryption, identity and access management, data handling, sub-processors (synchronised with Sub-Processor List v2.1), backup and disaster recovery, monitoring and incident response, and frequently asked security questions. |
| 1.1 | 22 September 2026 | Synchronised the Sub-Processor List cross-reference in Section 5 to Version 2.2 (effective 31 August 2026), which broadened the GetStream entry to cover Communities. No change to the summarised list of sub-processors. |
| 1.2 | 28 September 2026 | Added OpenAI to the AI Services summary in Section 5 and to the AI providers FAQ in Section 8, reflecting its use (via Vercel AI Gateway) for voice-note transcription in coach–client messaging. Synchronised the Sub-Processor List cross-reference to Version 2.3 (effective 28 September 2026). |
| 1.3 | 30 September 2026 | Synchronised the Sub-Processor List cross-reference in Section 5 to Version 2.4 (effective 30 September 2026), which corrects the processing regions for GetStream, Typesense, SigNoz, and OpenReplay. Section 3 now refers to the Coach Success team by its correct name. No change to security controls. |
| 1.4 | 2 October 2026 | Named Baseten as the provider serving DeepSeek models in the AI Services summary (Section 5) and the AI providers FAQ (Section 8). Synchronised the Sub-Processor List cross-reference to Version 2.5. No change to security controls. |
| 1.5 | 5 October 2026 | Added SerpApi to the Search summary and Cartesia to the AI Services summary in Section 5, and described both in the AI providers FAQ in Section 8, reflecting their use for the AI research agent and AI agent voice recaps. Synchronised the Sub-Processor List cross-reference to Version 2.6. No change to security controls. |
For questions regarding changes between versions, contact compliance@kahunas.io