01Reporting a Vulnerability
Email [email protected] with steps to reproduce and, where relevant, a proof of concept. We acknowledge reports within 2 business days and aim to give you a remediation timeline within 10 business days. We will not pursue legal action against researchers who report in good faith, avoid privacy violations and service degradation, and allow reasonable time to fix before disclosure.
02Infrastructure
All traffic is served over TLS 1.2+, with certificates issued and rotated automatically. The API, database and cache run in isolated containers behind a reverse proxy; the database is not exposed to the public internet. Databases are backed up daily to encrypted offsite object storage with 14-day retention. Application errors are captured in a self-hosted error tracker, and customer payloads are not attached to error reports.
03Authentication and API Keys
Passwords are hashed with bcrypt — we never store them in plain text and cannot recover them. Sessions use signed, HttpOnly cookies with CSRF double-submit protection on state-changing requests. Failed logins are rate-limited per account and per IP address.
API keys are scoped to your account and can be rotated or revoked at any time from your dashboard, taking effect immediately. Keep keys server-side: never embed them in client-side code, mobile binaries or public repositories. If a key is exposed, rotate it.
04Payments
We do not store, process or transmit card numbers. Card data is handled entirely by our payment processors (Stripe and PayPal), who are PCI-DSS Level 1 certified. Payment webhooks are cryptographically signature-verified before they are accepted.
05Data Handling
The personal data we hold, the legal bases for processing it, our subprocessors and your rights are set out in the Privacy Policy. Business customers who require a Data Processing Agreement can request one at [email protected].
06Responsible Use
Automated abuse, credential sharing, and scraping intended to recreate the core service are prohibited under the Terms of Service and will result in suspension.
07What We Do Not Claim
We would rather be accurate than impressive: KickoffAPI is not currently SOC 2, ISO 27001 or PCI-DSS certified in its own right. If your procurement process requires a formal certification, contact us at [email protected] and we will tell you honestly whether we can meet it.