Your docs hold your company's secrets. We treat them that way.
Here is how Kenfolio is built to keep the right pages in front of the right people, and nobody else. Questions? Write to support@kenfolio.com.
Permissions checked in one place
Who can see a page is decided by the database itself, for every request, search result, notification and AI answer. There is no second copy of the rules to drift out of sync.
Short-lived sessions
Sign-in tokens last 15 minutes and renew silently. Renewal tokens rotate on every use, and a stolen one that gets reused is caught and the session is ended.
Passwords stored safely
Passwords are hashed with scrypt and a unique salt. Sign-in, sign-up and reset are rate limited. Google sign-in is available on every plan.
Private file storage
Uploads go to private storage. Every download uses a link that expires after five minutes and is issued only after a permission check.
Clean content
Every page is cleaned on the server before it's saved, so pasted or imported content can't run scripts in a reader's browser.
Scoped API tokens
Tokens have scopes and an expiry date, act with their owner's permissions, are stored only as a hash and can be revoked instantly.
Audit log
Publishing, sharing, permission changes, exports and token activity are recorded with who did it, when and from where.
Your data is yours
Admins can export everything at any time. Deleted pages wait in the trash for 30 days, then are removed for good, files included.
Straight answers for your security review.
We'll fill in your security questionnaire and walk your team through the architecture on a call.
Where is my data stored?
In a managed PostgreSQL database and private object storage with our hosting provider. Data is encrypted in transit with TLS. Ask us about the region and at-rest encryption for your workspace.
Do you have SOC 2 or ISO 27001?
Not yet. We'll tell you honestly where we are and share our controls in detail during a security review.
Do you support SAML single sign-on?
Google sign-in is available today. SAML SSO and SCIM provisioning are on our roadmap; tell us your identity provider and we'll keep you posted.
Who at Kenfolio can see my content?
Only engineers who need to, to fix a problem you've reported, and only with your permission.
How do I report a vulnerability?
Email support@kenfolio.com with the subject "Security". We reply within two working days and won't take action against good-faith research.