Every control described below applies to every account on every plan, including the $79 Solo tier. A practice holding a hundred SSNs needs the same protection as one holding ten thousand, and charging for that would be an odd way to run a company that wants to be trusted with either.
Not "recommended", not "available in Enterprise". Every account with a password — staff and client alike — requires an authenticator app.
RFC 6238 authenticator apps — Google Authenticator, Authy, Microsoft Authenticator, any compliant app. SMS-based 2FA is deliberately not offered: authenticator apps are phishing-resistant and immune to SIM-swap attacks.
A 10-character minimum with upper case, digit and non-alphanumeric — then several more gates before a password is accepted.
Authentication cookies are HttpOnly, Secure and SameSite-pinned with an 8-hour sliding expiration. The two-factor challenge runs on a separate 10-minute non-sliding cookie.
Sign-in and password-reset responses are deliberately generic, so neither can be used to discover which email addresses have accounts.
This is the question every firm asks second, right after "is it encrypted". The honest answer is a short list, and we would rather publish it than be vague about it.
Every AI-powered feature passes through a moderation layer before the primary call, applied by middleware as well as at the service. It blocks prompt injection, system-prompt and API-key extraction attempts, database schema probing, and inappropriate content.
Legitimate questions are never blocked. Custom validation patterns run under a 250-millisecond timeout, so a crafted pattern cannot be turned into a denial-of-service.
The help assistant answers only from Kveldo's own documentation via keyword retrieval — staff and client corpora are separate, so a client cannot ask about staff features and get a useful answer.
The full transitive graph is pinned by a lock file, and CI restores in locked mode. Dependabot keeps it current.
CI fails the build on any known-vulnerable package. Not a warning — a failure.
SAST runs on every build across the whole repository, failing on error-severity findings — single-threaded with an extended timeout, because a scanner that silently drops findings under load is worse than none.
A pre-commit hook scans staged changes with four independent detectors, including provider key-shape detection that fires regardless of the variable name a key was pasted into.
Tax preparers are "financial institutions" under the Gramm-Leach-Bliley Act, which means the FTC Safeguards Rule applies and a written information security plan is required. Kveldo is not your WISP — but it is the system most of your WISP will describe.
Access controls and role-based permissions, multi-factor authentication on every account, encryption of customer information at rest and in transit, a change-management and audit trail, monitoring of authorized user activity, and secure disposal — deleting a file removes the blob and the database row, with the deletion audited to the client timeline.
Designating a qualified individual, running your own risk assessment, training your staff, vetting your other service providers, and keeping the written plan current. Kveldo supplies the controls your plan has to describe, documented so you can reference them directly.
Need our security documentation for your own assessment? Ask us — we will send what we have rather than hide behind an NDA wall.
We would rather answer it before you sign up than after. Start a trial, or talk to us first — either order works.