Security
Kioo holds children's names, email addresses and study records. Not the most valuable data on the internet, but it belongs to people who did not choose the risk — so we treat it carefully and we say what we actually do.
1. Data in transit
- All traffic between the app, the website and our API uses HTTPS with TLS 1.3.
- Certificates are issued and renewed automatically by Let's Encrypt through Caddy — no manual renewal to forget.
- Plain HTTP is redirected to HTTPS. There is no unencrypted path to our API.
2. Data at rest
- Application data is stored in a MySQL database on a hardened server in a DigitalOcean data centre in Frankfurt, Germany.
- Passwords are stored only as salted one-way hashes using a modern algorithm. We cannot read your password, and a support agent cannot either — if we could, so could an attacker.
- Database backups are encrypted and access-controlled.
- Homework photographs are deleted from our servers once an AI answer has been generated. They are not archived.
3. Access control
- Administrative access is limited to the small number of people who need it to do their job.
- Server access is by SSH key. Password authentication is disabled.
- Administrative actions in the content dashboard are logged.
- Third-party API credentials are held as server-side secrets, never shipped in the mobile app.
4. Application security
- All API input is validated and parameterised — no string-built SQL.
- Authentication uses signed tokens with expiry; sessions can be revoked server-side.
- Rate limiting protects sign-in, password reset and the AI Tutor endpoints against brute force and abuse.
- Password reset and email-verification links are single-use and time-limited.
- Changing an email address requires verification of the new address, so a mistyped or hostile change cannot lock you out.
- A forced-update mechanism lets us retire an app version quickly if a security problem is found in it.
- Dependencies are kept patched, and changes are reviewed before they ship.
5. Payments
Kioo does not store card numbers, CVVs or Mobile Money PINs — we never receive them. Card details are entered on Flutterwave's PCI-DSS compliant checkout. We hold only a transaction reference, an amount, a status and the payer's phone number, which is what we need to activate your subscription and handle refunds.
6. Security decisions we made in the product
Some of the strongest protections are architectural:
- No user-to-user features — no chat, no profiles, no sharing. An entire category of abuse simply does not exist in Kioo.
- No advertising SDKs — no third-party code running in the app with access to your data.
- Minimal collection — no location, contacts, microphone, or advertising IDs. Data we never collect cannot leak.
- Ephemeral photos — the most sensitive thing a user sends is deleted within seconds of being useful.
7. If something goes wrong
No system is perfectly secure, and we do not intend to pretend otherwise.
- We contain the issue and shut down the affected path, even if that means downtime.
- We investigate scope: what was accessed, by whom, and for how long.
- Where a breach creates a real risk to people, we notify affected users and the relevant data protection authority without undue delay, and in any case within the statutory window.
- We publish what happened and what we changed.
8. Responsible disclosure
If you have found a vulnerability in Kioo, we want to hear from you.
| Report to | security@kioo.site |
|---|---|
| Acknowledgement | Within 3 working days |
| Assessment | Within 10 working days |
| Please give us | Up to 90 days to fix before public disclosure |
What to include
- What the issue is and where — a URL or API endpoint.
- Steps to reproduce it, and what an attacker could achieve.
- Any proof-of-concept, and your name if you would like credit.
Our commitment to you
If you follow this policy in good faith, we will not pursue legal action against you, and we will not treat your research as a breach of our terms of service. We will keep you updated, credit you if you would like it, and tell you when the fix ships.
Please do
- Test only against your own account and your own data.
- Stop as soon as you have confirmed a vulnerability exists.
- Report promptly and privately.
Please don't
- Access, modify or download data belonging to other users — especially children's data.
- Run denial-of-service, volumetric or load tests against production.
- Use social engineering, phishing or physical intrusion against our staff or suppliers.
- Deface content, degrade the service, or leave test data behind.
- Disclose the issue publicly before we have had a reasonable chance to fix it.
In scope
The Kioo Android app, the Kioo API, and kioo.site including the Pro checkout and admin surfaces.
Out of scope
- Findings from automated scanners without a demonstrated impact.
- Missing security headers, cookie flags or TLS configuration with no exploitable consequence.
- Rate-limit or brute-force reports without a working bypass.
- Vulnerabilities in third-party services we use (Flutterwave, Google, Anthropic, Resend, DigitalOcean) — please report those to them directly.
- Self-XSS, clickjacking on pages with no sensitive action, and social-engineering scenarios.
- Issues requiring a rooted device, a physically compromised handset, or an outdated browser.
We do not currently run a paid bug bounty. We will always credit you publicly if you want it, and we will always say thank you properly.
9. Contact
Security reports: security@kioo.site
Privacy requests: privacy@kioo.site
Child safety: safety@kioo.site
Kioo Education, Kampala, Uganda.