Security
Last updated:
How Kidslen protects family data: HTTPS everywhere, encryption at rest, a deny-by-default API, secrets management and audit logs.
Transport security
All traffic between the companion app, the dashboard and our API uses HTTPS with modern TLS. HSTS is enabled on every domain, and plaintext connections are refused.
Encryption at rest
Databases, backups and object storage are encrypted at rest. Platform access tokens the child grants are stored encrypted with keys held outside the database.
Deny-by-default API
Every API route requires authentication and an explicit permission check. A parent can only read the families they belong to; a child device can only write its own activity. Anything not explicitly allowed is denied.
Secrets management
Signing keys, database credentials and platform client secrets are kept in a secrets manager, injected at runtime and rotated on a schedule. They are never committed to source control or baked into app binaries.
Audit logs
Security-relevant actions — sign-ins, policy changes, enrollments, exports and deletions — are written to an append-only audit log. Parents can review their family’s log in the dashboard.
Responsible disclosure
If you believe you have found a vulnerability, email [email protected] with “security” in the subject. We acknowledge reports within two business days, keep you updated, and credit researchers who wish to be named. Please avoid accessing other families’ data while testing.
User guide FAQ Children’s privacy Privacy policy Contact us Back to home