Security

Security is a core part of how we build and operate. This page describes the practices and controls we apply to protect your data and the systems we build.

Infrastructure Security

• Servers are hosted on reputable cloud platforms with SOC 2 certification
• Databases are not publicly accessible; access is restricted by network rules
• Backups are taken regularly and stored in a separate location
• Secrets and API keys are managed via environment variables, never committed to version control

Application Security

• All user inputs are validated and sanitised on both frontend and backend
• API endpoints require appropriate validation; rate limiting is applied to public endpoints
• CORS policies restrict which origins can interact with our APIs
• We follow OWASP Top 10 guidelines in all development work

Client Project Security

For client projects, we apply the same security standards to everything we build. This includes:

• Secure handling of any credentials or API keys provided by clients
• No storage of sensitive credentials beyond the duration of the project
• Code review for security issues before delivery
• Documentation of any security-relevant configuration the client needs to maintain

Responsible Disclosure

If you discover a security vulnerability in our website or services, please report it responsibly by contacting us at security@kytestudios.com before disclosing it publicly. We will investigate and respond within 72 hours, and we will credit you for responsible disclosure if desired.

Please do not attempt to access, modify, or delete data that does not belong to you during any testing.

Incident Response

In the event of a security incident affecting client data, we will notify affected clients within 72 hours of becoming aware of the breach, provide details of what data was affected, and take all reasonable steps to contain and remediate the issue.