Security
Last updated:
How Kidslen protects family data: HTTPS, device credential storage, account permissions, secrets configuration and audit logs.
Transport security
All traffic between the companion app, the dashboard and our API uses HTTPS with modern TLS. HSTS is enabled on every domain, and plaintext connections are refused.
Device credentials and stored data
Platform session credentials stay in the device’s Keychain/Keystore and WebView session store; they are not uploaded to Kidslen’s backend. The service stores account, activity, location and family communication data. Infrastructure encryption and backup controls must be verified for the actual hosting environment; this page does not claim encryption for every storage layer.
Deny-by-default API
Every API route requires authentication and an explicit permission check. A parent can only read the families they belong to; a child device can only write its own activity. Anything not explicitly allowed is denied.
Secrets management
Server credentials and distribution signing keys are supplied through deployment/CI secrets rather than committed to source control. Public client identifiers in the apps are not secret keys. Operators manage credential rotation and access to the deployment environment.
Audit logs
Security-relevant actions, including sign-ins, consent changes, enrolments, exports and deletions, are recorded for operational review. Audit records have a retention period; the dashboard does not currently provide a full family audit-log viewer.
Responsible disclosure
If you believe you have found a vulnerability, email [email protected] with “security” in the subject. We acknowledge reports within two business days, keep you updated, and credit researchers who wish to be named. Please avoid accessing other families’ data while testing.
User guideFAQChildren’s privacyDelete your Kidslen accountPrivacy policyContact usBack to home