Kitscore helps brands and teams decide who to sponsor, so we hold sensitive information: creator profiles and campaign history, contracts, approval notes, and payment references. This page describes the protections that are in place today, where your data is processed, who helps us process it, and where our security program stands. We state only what is true today and update this page as that changes.
At a glance
Traffic to Kitscore is encrypted in transit (HTTPS with HSTS).
Access to data is enforced inside the database with row-level security, not only in the app.
Sensitive actions are recorded in a tamper-evident audit trail.
Automated security checks run on every code change.
Our primary database is hosted in Ireland (AWS eu-west-1); application servers currently run in the United States.
We are building toward a SOC 2 report. We do not yet hold one.
1. Protecting data
In transit. All traffic to kitscore.co uses HTTPS, and browsers are told to require it (HSTS).
At rest. Stored data is encrypted at the storage level by our database and hosting providers.
Payments. Card details are handled by Stripe. We never see or store full card numbers.
Connected accounts. Creators connect YouTube, Instagram, TikTok and similar accounts through each platform’s official sign-in. The resulting access tokens can be read only by our servers, never from a browser, and are deleted when a creator disconnects.
Minimising what AI sees. Where a feature uses AI, we limit and truncate the text we send to what the feature needs.
2. Controlling access
Row-level security. Our database enforces who can read and change each record. Users see their own data and their own team’s data.
Least privilege. We reduced the number of database functions that can be called without signing in by more than 80%, and we review them on a recurring schedule.
Administrator functions. Administrator-only functions are tested on a recurring schedule with a non-administrator account to confirm they refuse access.
Roles inside your team. Customer teams have owner, admin and member roles, and invitations are controlled by the account owner.
Rate limiting. Public and cost-bearing actions are rate-limited per client.
3. Audit trail
Evaluations, approvals, pipeline moves, and access changes are logged with timestamps. Our core audit log is append-only and chained with SHA-256 hashes, so any later tampering is detectable, and the chain is verified daily. Team owners can export their team’s audit trail to CSV.
4. How we build and ship
Automated checks on every change: a dependency vulnerability audit, a secret scan, and tests that confirm our row-level security rules still hold.
Dependency alerts and security updates are switched on for our code repository.
Secret scanning. Our most recent full-history scan of the codebase found no exposed credentials.
Database changes are versioned and rehearsed in a rolled-back transaction before they are applied.
Server-side request forgery protection. Our servers only fetch public web addresses when a user supplies a link.
Error handling. Errors shown to users carry no internal detail; the full detail is logged on the server.
Browser protections: HSTS, clickjacking protection, content-type protection, a strict referrer policy, and a restrictive permissions policy.
5. Where your data is processed
Our primary database and file storage are hosted by Supabase on AWS in Ireland (eu-west-1). Our application servers run on Vercel and currently operate in the United States, so some processing happens there. Our subprocessors may also process data in other locations (see below). For how international transfers are handled, see section 10 of our Privacy Policy.
6. Subprocessors
These providers help us deliver Kitscore and may process customer data on our behalf:
Provider
What it does for us
Where
Supabase
Database, sign-in, and file storage
Ireland (AWS eu-west-1); US parent company
Vercel
Web hosting and application servers
United States
Stripe
Payments, subscriptions, invoicing, and escrow payouts
AI processing for contract clause scans, contract text extraction, exclusivity and disclosure checks, and brand-safety scans
United States
Cal.com
Demo scheduling on our website (prospects only)
Provider-managed
Proton
Company email
Switzerland
Not subprocessors: Google/YouTube, Meta/Instagram, TikTok, Twitch and Discord are platforms a creator chooses to connect; they are sources of data, not providers working for us. If you set up a Slack digest, Kitscore sends notifications to your own Slack workspace, and Slack is your provider.
Customers with a signed data processing addendum are notified of subprocessor changes as that addendum describes.
7. Compliance program
SOC 2. We are building toward a SOC 2 report. We have written a control framework of 29 controls mapped to the SOC 2 trust services criteria, plus the policies behind them, and we are collecting evidence. We do not currently hold a SOC 2 report or certification.
Written policies cover access control, change management, vulnerability management, incident response, vendor management, risk management, and data classification.
Privacy documentation. We have prepared a record of processing, an impact assessment for our scoring and AI features, a transfer assessment, a data retention schedule, and a breach response plan.
We maintain a documented incident and breach response plan. If an incident affects your data, we will tell you without undue delay and help you meet your own notification obligations.
9. Reporting a vulnerability
If you believe you have found a security issue, email hello@kitscore.co with the subject “Security”. Please include enough detail to reproduce it, and please do not access or change other people’s data while testing. We will acknowledge your report and keep you informed.
10. For enterprise customers
If your procurement or security team needs more, contact hello@kitscore.co. We can discuss a data processing addendum and respond to security questionnaires.