Security at Khula ERP
Khula holds your ledgers, your payroll and your people's personal information. This page says what we actually do to protect it — and, at the bottom, what we have not built yet.
Data protection
Encryption
Traffic between your browser and Khula is encrypted with TLS, and we serve the application over HTTPS only. Data at rest is encrypted by our database and storage providers using their managed keys. We do not operate our own key-management system, and we do not claim to.
Tenant isolation
This is the control we have invested most in. Every database query in Khula is filtered by tenant, and that filtering is enforced at three independent layers rather than trusted to the calling code. One business cannot read another's data, and the system is built so that a developer mistake fails closed rather than leaking.
Backups
Your data sits in a managed PostgreSQL service with automated daily backups and point-in-time recovery provided by the platform. Restores are available on request. We have not yet run a full documented restore drill for a customer tenant.
Access and accountability
Authentication
Sign-in is email and password, with password strength requirements, lockout after repeated failed attempts, and short-lived session tokens that refresh automatically. Multi-factor authentication and single sign-on are on our roadmap and are not available today.
Role-based access control
Permissions are granular and checked on the server for every request, not hidden in the interface. You define roles that match how your business actually separates duties — the person who captures a bill need not be the person who can pay it.
Audit logging
Changes to records are written to an audit trail capturing who acted, what changed and when. In the accounting modules this goes further: a posted transaction is never deleted, it is reversed by a counter-entry, so the history an auditor needs cannot be erased.
Infrastructure
Hosting
Khula runs on managed cloud infrastructure with a managed PostgreSQL database. Our providers hold their own security certifications for the facilities and platforms they operate. Those are their certifications, not ours, and we do not present them as though Khula had been audited.
Application security
The application enforces CSRF protection on state-changing requests, validates input at its boundaries, applies request timeouts and query bounds, and uses parameterised SQL throughout. Secrets live in the deployment environment, never in source control.
Compliance
POPIA
Khula is built around South Africa's Protection of Personal Information Act. Personal information is isolated per tenant, access is controlled by role, and processing activity is logged. As our customer you remain the responsible party for your own data and Khula acts as your operator. Our privacy policy sets out how we handle information you give us directly.
Financial record-keeping
The accounting core is double-entry and balances to the cent, periods close in order and stay closed, and VAT figures carry the evidence they were derived from. This is what a reviewer or an auditor will ask you for.
What we have not built yet
We are a young company and we would rather you learn this here than in a procurement questionnaire.
- No SOC 2 or ISO 27001 certification. We have not been audited against either standard.
- No multi-factor authentication or SSO in the product today.
- No independent penetration test has been commissioned yet.
- No 24/7 staffed security operations. We monitor errors and availability, and we respond during South African business hours.
If any of these is a hard requirement for your business, tell us before you buy rather than after. We will give you a straight answer about whether and when we can meet it.
Reporting a vulnerability
If you find a potential security problem in Khula, report it to security@khula-erp.com. We will acknowledge your report, keep you updated while we investigate, and we will not pursue legal action against anyone acting in good faith.
Questions
For security questions or a vendor assessment, contact us at hello@khula-erp.com. See also our Privacy Policy and Terms of Service.