How Kawaa protects your data: encryption in transit and at rest, access control, data handling, and how to report a security issue.
Infrastructure security
- Encryption in transit - The website, dashboard, API and status page all use TLS 1.2 or later
- Encryption at rest - Account data, verification results and uploaded lists are encrypted with AES-256
- The results cache - Traffic between our verification servers and their results cache, inside our private AWS network, is encrypted and needs a password. The cache itself is encrypted at rest.
- AWS hosting - Enterprise-grade infrastructure
What is not encrypted
- The mailbox check - Checking whether a mailbox exists is an SMTP conversation with the mail server that receives mail for the address. It is not encrypted, so the address is sent to that server in plain text.
- DNS lookups - Looking up the address's domain uses ordinary, unencrypted DNS queries. They carry the domain only.
Access control
- Team roles (owner, admin, member, viewer) for managing a team's members and settings: admins manage members and viewers, and only the owner can change, suspend or remove an admin (Starter plan and above)
- Two-factor authentication (2FA) for dashboard sign-in with a password, which a team can require of its members. It does not cover signing in with an API key: anyone with one of your keys can sign in to the dashboard with it unless your team requires 2FA, so keep keys secret and revoke any you no longer use
- Hardware security key support (FIDO2) - coming soon
- Audit log of account, security and billing actions (Enterprise plan)
Account protection
- A dashboard session ends 24 hours after sign-in, whether or not you are active. You can end any session sooner from Settings → Security. Ending sessions does not disconnect connected apps or turn off API keys
- Changing or resetting your password signs out every dashboard session and disconnects every connected app, such as an AI assistant you connected by signing in. If you think someone else had access, also revoke any API key you don't recognize in Settings → API keys (to revoke your only key, create a new one first)
- Revoking an API key switches off the webhooks created with it, and disconnecting a connected app switches off the webhooks the app created. Changing or resetting your password disconnects every app, so their webhooks are switched off too. A switched-off webhook stays in Settings → Webhooks with the reason, until you turn it back on or delete it
- Webhooks added from the dashboard keep sending events after a password change or a sign-out. If you think someone else had access, review your webhook endpoints in Settings → Webhooks and delete any you don't recognize
- After your first successful sign-in, verified accounts receive a security email when a password or API key is used from an unrecognized browser or device. Security-alert preferences apply, even when general email notifications are off. Sub-accounts do not receive these notices.
- Changing your password or email, turning two-factor authentication on or off, deleting your account, and deleting or handing over a team ask for your current password, with at most 10 attempts per 15 minutes
- Creating an API key, connecting an app, issuing a sub-account key, adding a webhook, changing a webhook's URL or events, or turning back on a webhook Kawaa switched off, from the dashboard, needs a sign-in within the last 15 minutes
Requiring two-factor authentication for a team
A team owner can turn on Require 2FA in the team's settings. While it is on:
- Every member, the owner included, signs in to the dashboard with a password and a code from their authenticator app (or a backup code)
- Members cannot sign in to the dashboard with an API key. Their API keys still work for API requests
- A member without two-factor authentication cannot sign in to the dashboard. The owner can remove them from the team, or turn the requirement off while they set it up
- An invitation to the team can only be accepted by an account that has two-factor authentication on
Only the owner can turn the requirement on or off, and the owner needs two-factor authentication on their own account to turn it on. Ask your members to turn it on in Settings → Security before you require it.
Locking your account
If you think your account has been taken over, you can lock it with POST /v1/security/lock-account and your password. Locking signs out every dashboard session, turns off every API key, disconnects every connected app, cancels any change of email address that has not been confirmed yet, and stops all sign-in to the account.
A lock does not expire, and a locked account cannot unlock itself, because nothing can sign in to it. To have the lock lifted, email support@kawaa.com from the account's email address. Once it is lifted, sign in with your password, create new API keys and connect your apps again: the keys the lock turned off stay off, and so do the apps it disconnected. A lock switches off the webhooks your API keys and connected apps created, but leaves the ones added from the dashboard in place, so also review them in Settings → Webhooks and delete any you don't recognize.
This is different from the temporary lock after repeated failed sign-in attempts, which ends on its own after 30 minutes or more.
Data handling
- Verification results are encrypted at rest and keyed by a one-way hash of the address
- Results are retained for your plan's retention period (7-365 days), then deleted
- Kawaa never reads your mailboxes; it only processes the addresses you submit
Security reporting
Found a vulnerability? Report it to security@kawaa.com. We acknowledge every report.