Security built into the application layer.

Application controls

• Provider secret credentials are stored server-side and are not intentionally exposed to the browser.
• User passwords are stored using PHP password hashing rather than plaintext passwords.
• Authenticated write actions use CSRF protection where implemented.
• Database operations are designed to use prepared statements for user-supplied values.
• Administrative access is separated from ordinary customer access.
• Audit records are available for selected administrative actions.

Transport security

Production deployments should use HTTPS throughout. Customers should not enter credentials or payment information on a deployment that is not protected by valid HTTPS.

Payment data

KazataCloud uses hosted/integrated payment-provider flows where configured. Card details should be entered only into the payment provider's authorized payment experience, not stored directly in KazataCloud.

Reporting security concerns

Security reports can be sent to security@hoddz.com.