Security

Infrastructure Security

• Hosted on Railway (US-based) with managed infrastructure
• PostgreSQL database managed by Railway with automated backups
• S3-compatible object storage via Railway Buckets for all uploaded documents
• HTTPS enforced on all endpoints
• Automated deployments from the main branch via Railway

Encryption

• In transit: TLS 1.2+ enforced on all connections
• At rest: AES-256 encryption via SSE-S3 for all stored documents
• Database encryption managed by Railway's PostgreSQL service

Data Backup & Recovery

• Database backups managed by Railway (frequency and retention depend on Railway's plan tier)
• Document storage (S3-compatible) provides built-in redundancy
• Recovery procedures available through Railway's managed infrastructure

Authentication & Access Control

• Clerk for authentication (SOC2 Type II certified)
• Session-based auth with secure, HTTP-only cookies
• API key authentication for the CLI and MCP server — keys stored as SHA-256 hashes
• Role-based access control (USER / ADMIN)
• Item-level ownership enforcement — users can only access their own documents
• Multi-factor authentication (MFA) available through Clerk

Administrative Access & Audit Logging

A small number of CandleKeep staff hold the ADMIN role, which can reach customer records for support and abuse investigation. Every such request is recorded.

• Reads are logged, not just changes. Opening a customer's library, sessions, support tickets or survey responses writes an audit record, the same as modifying them — from the admin console and from our internal tooling alike.
• Each record captures who acted, how they authenticated, what resource was touched, which customer it concerned, the source IP, and the timestamp.
• The log is append-only — enforced in the database, not just by convention, so records cannot be edited or deleted through the application.
• Failed privilege checks are recorded too, so an attempt to reach admin functionality without authorization is itself visible.

Data Retention

• Research questions expire. The question you type when your agent reads from your library is kept for 90 days and then automatically erased. Reading statistics survive; the question text does not.
• Deleting your account removes your documents and library data. Administrative audit records are retained, since a security log that can be erased by the party it describes is not a security log.

Vendor Security

We carefully vet our vendors for security and compliance. See our full subprocessor list for details.

Vendor compliance certifications are based on their published documentation as of March 2026. *GDPR compliance is self-reported by the vendor and has not been independently verified.

Change Management

• Git-based development workflow with pull requests for code changes
• Production deployments are automated via Railway and triggered from the main branch
• Full git history provides audit trail for all code changes

Incident Response & Breach Notification

As a small team, we do not yet have a formally documented incident response plan. However, in the event of a security incident or data breach, we are committed to:

• Investigating promptly using application and infrastructure logs
• Notifying supervisory authorities within 72 hours as required by GDPR Art. 33
• Notifying affected users without undue delay per GDPR Art. 34
• Notifying affected California residents within the most expedient timeframe per CCPA
• Email notification for all material breaches
• Post-incident review and remediation

Formalized incident response runbooks and proactive monitoring are on our SOC2 roadmap (see below).

Compliance

CandleKeep is designed to align with GDPR (EU) and CCPA (California) requirements.

Our compliance controls include:

• Privacy policy
• Cookie consent mechanism (opt-in)
• Data subject rights handling via email (access, deletion, portability requests)
• Data retention policy
• Subprocessor transparency

SOC2 Roadmap

We are working toward SOC2 certification. The controls listed below reflect our current security practices, which have not yet been independently audited:

• Access control: Clerk authentication + role-based access (RBAC)
• Encryption: TLS 1.2+ in transit, AES-256 at rest
• Monitoring: Railway infrastructure logs and PostHog product analytics
• Audit logging: append-only record of every administrative access to customer data, reads included
• Change management: Git-based workflows with automated Railway deployments

Planned enhancements:

• Formal access reviews
• Annual penetration testing
• Expanded audit logging
• Vendor risk assessments
• Centralized security logging and monitoring
• Documented incident response runbooks
• Employee security awareness training

Responsible Disclosure

We welcome security researchers who discover vulnerabilities in CandleKeep. If you find a security issue, please email [email protected].

We commit to:

• Acknowledging reports within 48 hours
• Providing regular status updates on reported issues
• Not pursuing legal action against researchers acting in good faith

Enterprise

For custom security agreements, Data Processing Agreements (DPAs), or compliance questionnaires, contact [email protected].