Security

Protecting money and personal data is the core of what Kudvi does. This page describes the technical and organisational measures BPLUS PRO LTD applies to the platform.

1. Encryption

All traffic between your device and Kudvi is encrypted with TLS 1.2 or higher. Personal data is encrypted at rest on our infrastructure providers' systems.

2. Payment security

Card and wallet data is collected and processed directly by Stripe, a certified PCI DSS Level 1 service provider. Kudvi never receives and never stores full card numbers.

3. Access control

Access to production systems and personal data follows the principle of least privilege, is limited to personnel who need it for their role, is protected by multi factor authentication, and is logged.

4. Monitoring and testing

The platform is monitored for anomalies and abuse. Dependencies are kept current, and security reviews are performed on significant changes.

5. Data handling

Verification documents are stored separately from operational data with restricted access. Backups are encrypted and tested. Retention and deletion follow the schedules in the Privacy Policy.

6. Responsible disclosure

If you believe you have found a vulnerability, email hello@kudvi.com with the details. We will acknowledge within two business days, keep you informed, and will not pursue good faith research conducted without harm to users or data. Please do not publish details before we have had a reasonable opportunity to fix the issue.

7. Incidents

We maintain an incident response procedure covering containment, remediation and notification. Where an incident affects your data or funds, we will inform you without undue delay.