Security & Compliance

Kapable takes security seriously. This guide covers the platform's security features, compliance controls, and best practices for keeping your organisation safe.

Authentication Methods

Magic Links (Default)

Every Kapable login uses a one-time magic link sent to the user's verified email. No passwords are stored or transmitted.

• Links expire after 10 minutes
• Each link can only be used once
• Links are cryptographically signed and scoped to a single org

Single Sign-On (SSO)

Organisations on paid plans can configure SSO through:

• Google OAuth 2.0 — uses Google Workspace identity
• Microsoft OAuth 2.0 — uses Azure AD / Entra ID identity
• Generic OIDC — any OpenID Connect provider (Okta, Auth0, Keycloak, etc.)

Configure SSO in Auth Settings in your console. When SSO is enabled, users authenticate through your identity provider and are automatically provisioned in Kapable.

API Keys

For programmatic access, create scoped API keys in the API Keys section. Keys use the kapi_ prefix and are transmitted via the Authorization: Bearer header or X-Api-Key header.

Session Management

Token Lifecycle

• Session tokens (kses_ prefix) are issued on successful authentication
• Tokens are stored in encrypted HTTP-only cookies
• Sessions expire after 30 days of inactivity
• Tokens are invalidated immediately on logout

Logout Everywhere

If you suspect a session has been compromised, use Logout Everywhere in your Account page. This instantly invalidates all active sessions across all devices and browsers.

Session Cookies

• HttpOnly — not accessible to JavaScript
• Secure — only sent over HTTPS
• SameSite=Lax — protection against CSRF
• Encrypted with a per-deployment secret (PrivateCookieJar)

Audit Logging

Every security-relevant event is recorded in the audit log:

Event	What's Recorded
Login	Email, IP, user agent, method (magic link / SSO)
Logout	Email, session duration
Failed login	Email attempted, IP, failure reason
API key created	Key name, creator email
API key revoked	Key ID, revoker email
Member invited	Invitee email, role assigned, inviter
Member deactivated	Target email, actor, reason
Role changed	Member, old role, new role, actor
Org settings changed	Field changed, actor

Access the full audit log at Auth Audit in your console. Export to CSV for compliance reporting.

API Key Security

Best Practices

1. Name keys descriptively — e.g., "CI/CD Pipeline" or "Monitoring Dashboard"
2. Rotate regularly — revoke and re-create keys every 90 days
3. Use environment variables — never commit keys to source control
4. One key per service — don't share keys between applications
5. Monitor usage — check "last used" timestamps in the API Keys page

Key Prefixes

All Kapable tokens use recognizable prefixes for easy identification:

Prefix	Type
kses_	Session token
kapi_	API key
kagent_	Agent key
kapp_	App token

Revoking Keys

Revoke a key immediately from the API Keys page or via the API:

DELETE /v1/auth/api-keys/{key_id}
Authorization: Bearer kses_your_session_token

Revocation is instant — any in-flight requests using the revoked key will fail.

Data Protection

Encryption in Transit

• All traffic uses TLS 1.2+ (enforced by Caddy with automatic HTTPS)
• Internal service-to-service communication uses private networking
• API endpoints reject plain HTTP connections

Encryption at Rest

• Database storage uses encrypted volumes
• Secrets are stored in age-encrypted vault files
• Session tokens are hashed before storage

Compliance Features

Domain Allowlists

Restrict who can sign up or be invited to your organisation by configuring allowed email domains in Auth Settings.

• Only email addresses matching allowed domains can join
• Wildcard support for subdomains
• Combine with SSO for maximum control

Signup Controls

Configure whether your organisation allows:

• Self-signup — anyone with an allowed domain can create an account
• Invitation only — only explicitly invited users can join
• SSO-gated — users must authenticate through your SSO provider

Role-Based Access Control

Limit what members can do based on their assigned role. See the Roles & Permissions guide for details.

Incident Response

If you suspect a security incident:

1. Logout Everywhere — Account page → Logout Everywhere (invalidates all sessions)
2. Revoke API keys — API Keys page → revoke any potentially compromised keys
3. Check the audit log — Auth Audit → filter by suspicious activity, export CSV
4. Deactivate compromised accounts — Members page → deactivate affected members
5. Review auth settings — ensure SSO and domain allowlists are properly configured

Security Headers

Kapable sets the following security headers on all responses:

• X-Content-Type-Options: nosniff
• X-Frame-Options: DENY
• Strict-Transport-Security: max-age=31536000
• Referrer-Policy: strict-origin-when-cross-origin

Next Steps