Security at Kilito

Updated October 4, 2026

Your inventory, costs and sales records are your business. Here is how we keep them safe, in plain language.

Built on audited providers

• Supabase runs our database, sign-in and photo storage in the United States. Supabase is SOC 2 Type II audited.
• Cloudflare serves the app and protects it from attacks. Cloudflare is SOC 2 Type II and ISO 27001 certified.
• Anthropic powers AI entry and pricing research. Anthropic is SOC 2 Type II audited and does not use your data to train its models.

We chose providers that hold these certifications so your data sits on infrastructure that is independently checked every year.

Encryption

• Every connection to Kilito uses HTTPS, so data is encrypted in transit.
• Your data is encrypted at rest in the database and in photo storage.
• Passwords are hashed by our sign-in provider. Nobody at Kilito can see your password.

Your workspace is private

• Each workspace is isolated by database security rules. Other Kilito users cannot see your items, photos, notes or sales.
• You decide who joins your workspace and what role they have.
• Purchase costs and profit are visible only to the owner and the members the owner allows.
• Public QR cards are off unless you turn them on. Even then, buyers only see the title, grade, cert number and asking price. Costs and notes are never shown.

Your account

• You can turn on 2-step login for an extra layer of protection.
• Invite links expire after 14 days.
• Our team accesses a workspace only to keep the service running, or for support when you ask for help.

Backups and recovery

• The database is backed up every day, and backups are kept for 7 days.
• Deleted items go to Recently deleted for 30 days, so an owner or admin can restore them.
• You can export your inventory to CSV at any time and keep your own copy.

Payments

When paid plans launch, payments will be handled by our payment processor. Kilito will never store your full card number.

Your data, your choice

• We never sell your data and never use it for advertising.
• You can ask us to delete your account and data at any time. We delete it within 30 days.
• Full details are in our Privacy Policy.

Report a security issue

If you think you have found a security problem, email hello@kilitocoin.com with the subject "Security". We read every report and will reply quickly. Please give us a chance to fix the issue before sharing it publicly.

Questions: hello@kilitocoin.com · Terms · Privacy · Security