Security and data handling
How Kitform looks after brand guides, including unreleased ones.
Where data lives
Kitform runs on Vercel. Accounts, brands and kept original files are stored in Vercel Blob storage, encrypted at rest by the provider, under long random names. Payments are handled by Stripe; Kitform never sees card numbers.
Access
- Every request is checked against the signed-in account: people only reach their own brands and the brands of teams they belong to.
- Passwords are stored as scrypt hashes. Sign-in, sign-up, password reset and imports are rate limited.
- Sessions, plugin codes, share links, invites and connector tokens are signed and can expire or be revoked. Share links stop working the moment sharing is turned off.
- The Claude connector uses OAuth 2.0: each person approves access, and tokens only reach their own workspaces.
Confidential brands
- Original files are kept only on plans with storage, and are deleted with their brand.
- Kitform does not use your files to train AI models, and doesn't send brand content to AI providers.
- Team owners see an activity log of members, roles, invites, brands and billing.
- You can export or delete your account and data at any time from your account page.
Agreements
A data processing agreement is available for companies: see the DPA. We're happy to sign an NDA for done-for-you work.
Reporting a vulnerability
Email support-email-not-set@example.com with details. Please give us a reasonable time to fix it before disclosure.