Security
Last updated: July 2026
Klikr is built for organisations that require reliable, POPIA-aligned notification infrastructure. This page outlines the technical and operational controls we apply to protect business and subscriber data. For contractual and legal detail, refer to our Privacy & POPIA policy and Terms of Service.
Encryption in transit
All traffic uses HTTPS (TLS). Push subscriptions use industry-standard Web Push (VAPID).
Password storage
Business and staff passwords are hashed with scrypt — never stored in plain text.
Sessions
HttpOnly, signed session cookies. Business sessions expire after 7 days; staff sessions after 24 hours.
Hosting
Application and data stored on Vercel cloud infrastructure with encrypted KV storage.
Access control
Business owners and staff have separate login flows. Staff can only access their referral dashboard.
Rate limiting
Login, signup, password reset, and send endpoints are rate-limited to reduce abuse.
Subprocessors
- Vercel — hosting, serverless functions, data storage
- Resend — transactional email (verification, password reset)
- PayPal — payment processing (when enabled)
- Google — optional sign-in (when enabled)
Customer responsibilities
Maintain strong account credentials and restrict staff access to authorised team members. Obtain lawful consent before messaging customers. Report suspected abuse or policy violations to hello@klikr.co.za.
Responsible disclosure
If you identify a security vulnerability, email hello@klikr.co.za with sufficient detail for reproduction. We will acknowledge and respond as promptly as practicable.