Security at Kshana API
A practical overview of how Kshana API protects accounts, workspaces, integrations, messaging events, and platform operations.
Last updated: August 7, 2026
Security approach
Kshana API uses administrative, technical, and organizational measures designed to protect customer data and maintain service integrity. Controls are selected according to the product architecture, data involved, and operational risk.
This page describes current practices and is not a representation that Kshana API holds a certification unless a specific certification is separately confirmed in writing.
Identity and tenant access
The application uses account and workspace controls intended to keep customer operations separated.
- Hashed passwords, short-lived access tokens, refresh-token rotation, session invalidation, and WebSocket reauthentication
- Role- and permission-based authorization for workspace and platform-administration capabilities
- Organization-scoped data access and server-side permission enforcement for protected operations
- Audit and operational records for selected security-sensitive, messaging, and administrative events
Data and integration protection
Production traffic is expected to use encrypted HTTPS and TLS connections. Sensitive developer and provider credentials are stored using configured encryption or secret-management controls and are not intended to be exposed to browser clients.
Meta webhook signatures are verified, webhook events are deduplicated, message state changes are ordered monotonically, and queued processing is used to isolate retries and transient provider failures.
Availability and operations
The platform includes dependency readiness checks, background job monitoring, retry handling, failed-message visibility, logging, and release checks. Customers should maintain their own exports, recovery procedures, authorized-user reviews, and integration credential rotation appropriate to their use case.
Report a vulnerability or incident
Send security reports to security@kshanaapi.com with SECURITY in the subject. Include the affected URL or component, observed behavior, impact, and reproducible steps. Do not access another customer's data, degrade the service, use social engineering, or publish a vulnerability before we have had a reasonable opportunity to investigate.
Kshana API does not currently promise a public bug-bounty payment. Good-faith reports are reviewed and handled according to severity and available evidence.