Security that keeps you and your visitors safe

Yes. Kanorio uses a two-tier backup model standard among modern cloud SaaS platforms: (1) Platform disaster recovery (included on all plans): databases and media assets are backed up and encrypted daily into an isolated cloud backup environment (database backups are retained for up to 90 days with continuous point-in-time recovery and quarterly restore drills) to recover the platform from major infrastructure incidents; (2) Self-service recovery (no support ticket needed): your dashboard includes 30-day version history for pages and blog posts (preview and restore a single page or entire site draft in one click), a 30-day media trash bin, 7-day undo for AI SEO fixes, a 30-day grace period for deleted sites (free-plan sites are also auto-archived after prolonged inactivity), and free full-site ZIP and order/contact CSV exports at any time. Platform-level backups are reserved for infrastructure disaster recovery; for everyday edits or accidental deletions on an individual site, use the built-in self-service restore tools.

Kanorio enforces multi-layer logical tenant isolation across both the database schema and application access layers. Every contact, order, form submission, media file, and setting is permanently bound to its owning website at creation, and cross-site ownership changes are blocked. Every request — whether from the dashboard, public endpoints, or external AI assistants (MCP) and the REST API — must pass site-scoped role and permission checks, backed by runtime isolation guards and automated dual-tenant contract tests.

Neither Kanorio staff nor support tools can view your keys. Credentials you submit are stored using industry-standard envelope encryption: each credential is encrypted with its own random AES-256-GCM data key, and that data key is wrapped by a master key held in FIPS 140-2 validated Google Cloud KMS (the master key never resides on Kanorio servers or databases and rotates automatically). Each ciphertext is cryptographically bound to its website and purpose, decrypted in memory only at the moment a payment, refund, or invoice action executes, and every change or decryption is recorded in an append-only audit log.

For account security, Kanorio uses passwordless authentication with support for phishing-resistant Passkeys (Face ID / Touch ID) and TOTP 2FA, active device session management with 1-click remote sign-out, and automatic email alerts for security events. For access control, teams assign Owner, Admin, or custom roles following least-privilege principles (members can request a missing permission right where they are blocked), and Personal Access Tokens (PAT) and OAuth 2.1 grants can be restricted by expiration date, read/write tier, and specific websites (rather than granting blanket access to all sites). Sensitive actions — such as exporting customer or order CSVs, adding a Passkey, widening API token permissions, or granting a team member sensitive permissions — require step-up re-authentication if more than 15 minutes have passed since login.

Never. Both Kanorio subscription billing and buyer checkout on your store are processed directly by PCI DSS-compliant payment providers (such as Stripe and supported regional gateways) via their secure payment elements or official authorization flows. Full card numbers and CVC codes never touch or get stored on Kanorio servers.

Kanorio minimizes third-party tracking by default: website fonts are self-hosted on our edge network (so visitor IPs aren't sent to external font servers), and online forms and checkout pages use built-in multi-layer checks, single-use tokens, and open-source ALTCHA device-side proof-of-work — blocking automated spam without Google reCAPTCHA or third-party tracking cookies. Built-in analytics anonymizes visitor IPs automatically and includes an optional GDPR / CCPA cookie consent banner. When owners or admins export contact or order CSVs after step-up verification, fields are automatically sanitized against spreadsheet formula injection.

Kanorio maintains two levels of append-only, tamper-evident audit logs: site-level Activity Logs cover 8 categories (Site, Content, Store, Orders, Marketing, Customers, Team, Settings), recording the actor's name, email, source IP, and whether the action was performed by an AI agent (including the API token name and prefix); account-level logs track 90 days of sign-ins and security changes. On the operations side, Kanorio continuously monitors for anomalous cross-site access and bulk data exports, and enforces automated static security analysis, secret detection, and regular dependency patching before code is deployed.

We state our compliance posture with complete transparency: the underlying cloud infrastructure providers Kanorio relies on (including Cloudflare, DigitalOcean, Neon, Google Cloud, Upstash, Resend, and Stripe) maintain independent SOC 2 Type II, ISO/IEC 27001, PCI DSS, or FIPS 140-2 certifications and Data Processing Addenda (DPAs) covering physical data centers, edge networks, compute virtualization, and managed database infrastructure. However, a sub-processor's certification does not automatically transfer to the SaaS application layer — Kanorio itself has not yet independently obtained a standalone SOC 2 or ISO 27001 certification. At the application layer, we enforce multi-tenant authorization isolation, Google Cloud KMS envelope encryption, runtime least-privilege separation, and tamper-evident audit logging, and publish our full sub-processor list and responsibility boundaries in the Help Center.

Site owners can remotely revoke all other device sessions, revoke API tokens, or restore content from 30-day version history at any time, and can check real-time service and API availability on our public status page (status.kanorio.com). For independent security researchers and enterprise security teams, Kanorio publishes a RFC 9116 /.well-known/security.txt file and a public Vulnerability Disclosure Policy (/vulnerability-disclosure, security@kanorio.com) defining scope, Safe Harbor protections for good-faith research, and response targets of 3 business days for acknowledgment and 7 business days for triage.