Trust
Security and where your data is stored
What is in place today, app by app. Nothing on this page is planned work unless it says so.
Last updated: 24 October 2026. Checked against the code and server set-up on 24 October 2026.
Where your data is stored
App records are the data you type into an app, including any location it records. Files and photos are what you upload. Our server is in India.
| App | App records | Files and photos |
|---|---|---|
| K-Finance | Database on our server in India | Your organisation’s own Google Drive or OneDrive, through connected storage. Company export packages, restore packages and audit evidence packs are saved in the same drive (folder “90 - Exports and Recovery”). Files and packages pass through our server only while they are uploaded, built or opened and are not kept on it. |
| K-Secretarial | Database on our server in India (part of the K-Finance application) | Your organisation’s own Google Drive or OneDrive, through connected storage; uploads are refused until a drive is connected. Files pass through our server while they are uploaded or opened and are not kept on it. Companies linked earlier through K-Secretarial’s own Google Drive link keep their older files in that Drive. |
| K-IPO | Database on our server in India (part of the K-Finance application) | Your organisation’s own Google Drive or OneDrive, through connected storage; uploads are refused until a drive is connected. Files pass through our server while they are uploaded or opened and are not kept on it. Files linked earlier through the K-IPO Google Drive link stay in that Drive. |
| K-MailSign | Database on our server in India | Logos, employee photos and banners on our server in India. They are publicly reachable at long random addresses, because the mail programs of the people you email must load them. |
| K-Tender | Database on our server in India | Your organisation’s own Google Drive or OneDrive, through connected storage; uploads are refused until a drive is connected. A tender document being read (OCR) is a short-lived working copy on our server, deleted when the reading ends (at the latest after 24 hours). GeM alert e-mails forwarded to your inbound address are kept on our server as received for 7 days, and their text for 14 days. |
| K-Projects | Database on our server in India, including the location added to a site photo | Your organisation’s own Google Drive or OneDrive, through connected storage; uploads are refused until a drive is connected. |
| K-CRM | Database on our server in India, including site-visit check-in positions | Your organisation’s own Google Drive or OneDrive, through connected storage; uploads are refused until a drive is connected. |
| K-Logistics | Database on our server in India | Your organisation’s own Google Drive or OneDrive, through connected storage (invoice copies, LRs, signed challans, B/Ls); uploads are refused until a drive is connected. Photo metadata is removed on upload. |
| K-Survey | Database on our server in India, including check-in and check-out positions and the client’s signature image, kept with the survey as evidence | Your organisation’s own Google Drive or OneDrive, through connected storage (site photos with their embedded location data removed, sketches and drawings); uploads are refused until a drive is connected. The printed survey report needs a sign-in; there are no public links. |
| K-HR | Database on our server in India, including attendance punch positions (taken only with the employee’s consent and deleted after 13 months by default) | Your organisation’s own Google Drive or OneDrive, through connected storage (ID proofs and employee documents, opened through K-HR only by HR managers, admins or the employee); uploads are refused until a drive is connected. |
| Khanal ID (sign-in) | Accounts, two-step settings and sign-in records on our server in India | None |
| Connected storage | Folder ids and document details (names, types, checksums, which record a file belongs to) on our server in India | Your own drive; files pass through our server while they are uploaded or opened and are not kept on it. Once a day a registry of your documents is written into your drive, so you can find every file without us. |
Backups
Everything on our server (every app database, and the files kept on the server as listed above) is in a nightly encrypted backup (restic) on the same server: 14 daily, 8 weekly and 12 monthly copies are kept, then deleted, so a backup expires within 12 months. Each app’s nightly database copy is also kept on the server for 14 days. Hostinger’s daily backup of the whole server is added once it is switched on; it is not on yet. There is no copy outside Hostinger. Files in your own drive are not in our backups; your drive keeps them.
Controls in place
One sign-in, with two-step verification
Every app signs in through Khanal ID using the OAuth authorisation code flow with PKCE (S256). Two-step verification with an authenticator app must be set up before any app opens.
Organisations kept apart
Each customer is a separate organisation; every record belongs to one organisation and is read only within it. K-Finance, K-MailSign, K-Tender, K-Projects, K-CRM, K-Logistics, K-Survey and K-HR each have their own database.
Roles and approvals
Each app has roles (for example organisation admin, site engineer, sales executive). K-Finance has maker-checker approvals. In K-Projects a change of a contractor’s bank details waits until a second person approves it.
Audit logs
K-Projects, K-CRM, K-Logistics, K-Survey and K-HR write every create, change and delete to an audit log linked as a hash chain, so a removed or altered entry shows. K-Finance keeps an audit trail with daily signed anchors. Khanal ID logs sign-ins and account changes.
Encryption
All traffic uses HTTPS with HSTS. Passwords are stored as hashes. Two-step secrets, Google and Microsoft tokens and K-Projects bank account numbers are stored encrypted, and backups are encrypted. Connected storage asks Google only for the files it creates or you pick (drive.file) and Microsoft only for its own app folder.
Browser protections
khanals.in sends a Content Security Policy that allows scripts and fonts only from this site and no inline scripts (styles may also come from the page itself), plus X-Frame-Options DENY, X-Content-Type-Options nosniff, a strict Referrer-Policy and a Permissions-Policy that turns off camera, microphone and location. The site loads no third-party scripts or analytics; it keeps its own visit totals per page and day, with no cookie, IP address or other visitor data (privacy policy).
Uploads
File types are checked by content, not by name. K-MailSign re-encodes every image it stores, removing metadata and anything embedded in it.
Server
Each app runs in its own PHP pool under its own system user. SSH accepts keys only, and repeated failed sign-ins are blocked. Releases are versioned and can be rolled back in one step.
On-server AI, off by default
Five apps offer short AI drafts: K-Projects, K-CRM, K-Logistics, K-Survey and K-Tender. They are off for every organisation until its admin switches them on. The model (Qwen2.5-1.5B-Instruct, open source, Apache 2.0) runs in llama.cpp on our own server in India and listens only on the server’s internal address; the apps refuse any other address, so record text never leaves the server and is never used for training. Drafts wait in a queue and run one at a time in the background, never during a page request, with a daily limit per organisation. Only people who can see a record can ask for or read its draft, and drafts stay within the organisation (email drafts only for the person who asked). Answers must match a fixed format or are thrown away, are shown as plain text labelled "AI draft — check before use", and change nothing by themselves. Dates, amounts and names come from the records, not from the model, and an answer with a link, phone number or bank details is thrown away. Logs keep lengths only, never the words. K-Finance, K-Secretarial, K-IPO, K-MailSign and K-HR have no AI features.
Reporting a problem, exporting and deleting data
How do I report a security problem?
Email hello@khanals.in with the word Security in the subject, the address or app, and the steps to reproduce it. Please do not access other organisations’ data or disrupt the service while testing. We reply within 1 working day.
How do I take a copy of my data?
Use the export in the app: K-Finance (with K-Secretarial and K-IPO), K-Tender, K-Projects, K-CRM, K-Logistics, K-Survey and K-HR have one. K-MailSign and Khanal ID have no export button yet; write to hello@khanals.in and we send you a copy.
How do I ask for my data to be deleted?
Write from your account email to hello@khanals.in; closure and deletion are done by us on request. Export what you need first; we delete the data within 90 days, except what the law requires us to keep. Encrypted backups expire within 12 months. Files in your own Google Drive or OneDrive stay there under your control.
More detail: privacy policy · terms · connected storage.