Security

KoffeeChat is run by Alttene Ventures Limited, a small company. We build on established providers for hosting, the database, payments and calls, and we add our own controls on top. We describe here what we actually do.

Alttene Ventures Limited has not completed its own SOC 2 or ISO 27001 audit. The certifications named on this page belong to our providers, not to us.

• Encrypted in transit. KoffeeChat is only served over HTTPS (TLS), and so are the connections between our app and our providers.
• Encrypted at rest by our providers. Our database and file storage are provided by Supabase, which encrypts stored data (AES-256).
• Row-level security on every table. Access rules in the database decide, row by row, what each signed-in person can read or change, so one person can’t open another person’s private data even by calling our database directly.
• Private files. CVs, call recordings and screenshots you add to a report sit in private storage and open only through links that expire after a few minutes.
• Least privilege. Visitors, signed-in people and our own server code each reach the database through a separate role with only the access it is given. The service key that can bypass the access rules is used only on our servers, never in the app your browser loads.
• Passwords. If you sign up with email, your password is stored by our authentication provider in hashed form. We never see it. You can also continue with Google instead.

When you pay for a plan, you enter your card details on Stripe’s or Paystack’s own checkout page. Your card details never reach our servers: we receive only your plan and whether the payment went through.

• Audio for coffee chat calls travels through LiveKit over encrypted connections. LiveKit doesn’t record calls.
• A call is recorded only when both people agree, and either of you can stop the recording at any time. Recordings, transcripts and summaries can be opened only by the two people in the call. Our team doesn’t open them.
• The audio is deleted 30 days after the call, and the transcript and summary after 12 months. Either of you can delete them sooner, for both of you.

• Choose what shepherds and visitors see, or hide your profile, in Settings → Privacy & visibility.
• Talents can delete their account in Settings; shepherds and organisations can ask us to. Deleting removes your profile, bookings, reviews, CV files and call recordings.
• Ask for a copy of your data, or a correction, by emailing legal@koffeechat.com.

We don’t use advertising trackers, and we don’t sell your data. With your consent, we count how KoffeeChat is used in our own database; our host, Lovable, gets technical reports (page addresses, load times and errors) to keep the app working. Our Privacy Policy has the details.

These certifications are held by our providers for their own services. They are not certifications of KoffeeChat or of Alttene Ventures Limited.

• Supabase (database, sign-in and file storage): SOC 2 Type II and ISO 27001. Supabase security
• Lovable (builds and hosts the app): SOC 2 Type II and ISO 27001:2022. Lovable Trust Center
• Stripe (card payments): PCI DSS Level 1 service provider. Security at Stripe
• Paystack (card payments): PCI DSS Level 1 service provider. Security at Paystack

Every provider we share data with, and why, is listed in our Privacy Policy.

If you think you’ve found a security problem in KoffeeChat, email legal@koffeechat.com with “Security” in the subject. Tell us what you found and how to reproduce it. We’ll confirm we’ve received it and keep you updated while we fix it.

While you look into it, please:

• use only your own accounts, or test accounts you created;
• don’t access, change or keep other people’s data beyond what you need to show the problem;
• don’t disrupt the service, for example with load or spam;
• give us reasonable time to fix it before you tell anyone else.

If you think your own account has been used by someone else, change your password and tell us straight away.