Security

Report a problemCopy Anchor Link

Email support@kapiworks.com with what you found, how to reproduce it, and any request IDs. Send no API keys and no personal data you do not need to. The same address is in this site's security.txt.

KeysCopy Anchor Link

• The key decides the company. A key reads only the company that created it, and addresses take no company selector.
• Keys hold 256 random bits and an 8-character checksum. The API checks the checksum before anything else, so a mistyped key is refused before it reaches Kapi's database.
• Kapi stores a SHA-256 hash of each key and its last four characters. Works Studio shows the key once, when it is created.
• A key expires within 365 days. A company has at most 10 active keys.
• Creating a key needs two-step sign-in and a sign-in within the last 15 minutes.
• A key can be limited to networks. Owners and admins are told when a key is used from a new network.
• A key sent in a web address is revoked at once, and owners and admins are told.

DataCopy Anchor Link

• Kapi Works keeps its database in London, United Kingdom. The providers that process it, what each does and where, are on the sub-processors list.
• The API is read-only. It answers GET and HEAD only.
• Responses carry only the fields the contract publishes, and names, work emails and check codes only with people:read.
• Responses send Cache-Control: no-store, X-Content-Type-Options: nosniff and Referrer-Policy: no-referrer, and no CORS headers.
• Cursors are sealed with AES-256-GCM, so they reveal nothing and an edited cursor is refused.

Call recordsCopy Anchor Link

Kapi records each call: the key, register, status, rows, time taken and request ID. The caller's network is kept as a prefix (/24 for IPv4, /48 for IPv6), not the full address. Call records are kept for 13 months, and the company's owners and admins can review recent calls in Works Studio.