At Kuot , security is not an optional feature — it is a core principle of our architecture.

This Security Policy outlines the technical and organizational measures we implement to protect information and ensure the confidentiality, integrity, and availability of our systems and data.

These measures are designed in accordance with:

• Article 32 of the General Data Protection Regulation (GDPR)

• Spain’s National Security Framework (ENS)

• Industry-recognized security best practices

1. Technical Security Measures

End-to-End Encrypted Messaging (E2EE)

Messages exchanged with your advisor are encrypted directly in your browser.

The key required to decrypt them is generated on your device and protected by your password. The key is never transmitted to our servers in plain text.

This means that neither the Kuot team nor a person with access to our database can read the contents of those conversations.

Important: if you lose the password protecting your private key, your previous messages cannot be recovered.

Technologies used
AES-256-GCM · RSA-2048 (OAEP) · PBKDF2 — 100,000 iterations

Encryption at Rest and in Transit

Your invoices, estimates, expenses, and tax documents are stored encrypted at rest using AES-256 and are always transmitted over secure TLS connections, with certificates managed and renewed automatically.

Tax documents do not use end-to-end encryption in the same way as messaging.

This is intentional: Kuot needs to process their contents in order to:

• Generate PDF documents.

• Calculate taxes.

• Submit records to the Spanish Tax Agency.

• Search through invoices.

• Perform the normal functions of the invoicing system.

Encryption that prevented the application itself from accessing these documents would also prevent these features from working.

Protection applied
AES-256 at rest · TLS 1.2+ · HSTS

Access Control and Authentication

Each row in the tables containing information is protected through policies enforced directly by the database engine using Row Level Security (RLS).

This adds a layer of protection independent from the application code. Even if there were a flaw in the interface, the database would continue enforcing its own rules to prevent users from accessing information that does not belong to them.

Kuot also uses:

• Role-based access control verified on the server.

• Principle of least privilege.

• Sessions with automatic expiration.

• Viewing and revoking active sessions from the account.

• Secure password storage using hashes.

Passwords are never stored in plain text or in a reversible format.

Controls applied
RLS · RBAC · Least privilege · Revocable sessions

Activity Logging and Auditing

We record relevant events related to platform security, including:

• Sign-ins.

• Failed access attempts.

• Permission changes.

• Administrative access.

• Operations performed on tax documents.

These records make it possible to reconstruct what happened in the event of a potential incident.

We do not claim to operate a security operations center staffed 24 hours a day. We do maintain access traceability and logging of relevant events.

Controls applied
Traceability · Access auditing · Event logging

Backups

Kuot has mechanisms intended to protect information in the event of data loss or an incident.

Backups are stored encrypted and on infrastructure located within the European Union, separately from the production database.

You can also generate and download your own backups from the application, without relying on Kuot to retain an additional copy of your information.

Protection applied
Encryption · EU storage · On-demand download

Internal note before publication: confirm whether automatic backups with a 30-day retention period are currently in place or whether backups are only available on demand. The original text contains both versions.

Incident Management

In the event of a security breach that may pose a risk to users’ rights and freedoms, Kuot will notify the Spanish Data Protection Agency (AEPD) where required under applicable law.

Where applicable, notification will be made within a maximum period of 72 hours after becoming aware of the breach, in accordance with Article 33 of the GDPR.

Where the breach may pose a high risk to affected individuals, Kuot will also communicate the incident directly to them in a clear and understandable manner, in accordance with Article 34 of the GDPR.

Related regulations
GDPR Art. 33 · GDPR Art. 34 · AEPD

2. Organizational Measures

Kuot’s security does not depend exclusively on technical measures. We also apply organizational procedures intended to reduce the risk of unauthorized access, errors, and vulnerabilities.

Principle of Least Privilege

Access to customer data is restricted to what is strictly necessary to provide the service.

Relevant access events are logged.

Confidentiality

All individuals who may access customer data are subject to confidentiality obligations.

Change Review

Changes affecting data access policies are specifically reviewed before being deployed to the production environment.

Vulnerability Management

We review the dependencies used by the project and prioritize patches related to critical vulnerabilities over other ongoing development work.

3. Infrastructure and Data Location

Kuot’s main infrastructure operates within the European Economic Area (EEA).

We work with providers that offer contractual safeguards related to data protection.

Database and Storage

Supabase on AWS
Indicated location: European Union.

Application Hosting

Vercel
Indicated location: European Union.

Payment Processing

Redsys
Spain.

Automated Invoice Data Extraction

Google — Gemini API
Processing related to this functionality may involve the processing of information outside the European Economic Area.

About Automated Data Extraction

When you use Kuot’s feature that automatically fills in an invoice or receipt from a document, that document is sent to Google’s Gemini API for processing.

According to the configuration described for this service, this international transfer is based on the Standard Contractual Clauses approved by the European Commission.

The document is processed on a one-off basis for the purpose of extracting the information required to complete the invoice or receipt.

This feature is optional.

If you prefer not to use it, you can always enter the document data manually.

Internal note before publication: contractually verify that the specific Gemini configuration used by Kuot guarantees that documents submitted through the API are not used for model training, and confirm the applicable mechanism for international data transfers.

4. Payments and Banking Data

Kuot does not directly store or process bank card details.

Payments are processed through Redsys, a payment platform used by the Spanish banking sector and certified under the PCI-DSS standard.

Card details are transmitted directly from the user’s browser to the payment gateway without passing through Kuot’s systems.

Kuot only receives the reference required to identify and manage the transaction.

Protection applied
No card storage · Redsys · PCI-DSS

5. Regulatory Compliance

Kuot designs its processes and systems with applicable data protection and invoicing regulations in mind.

GDPR — Regulation (EU) 2016/679

Governs the protection of personal data within the European Union.

Among its provisions, the following is particularly relevant:

Article 32 — Security of processing
Requires the implementation of appropriate technical and organizational measures to protect personal data.

LOPDGDD — Organic Law 3/2018

Complements and adapts the GDPR to the Spanish legal framework and regulates certain rights related to data protection and digital rights.

Law 11/2021 on Measures to Prevent and Combat Tax Fraud

Introduces obligations related to computer systems used in invoicing processes and the integrity of the records they generate.

VERI*FACTU

Kuot takes into account the requirements established, among other provisions, by:

• Royal Decree 1007/2023

• Order HAC/1177/2024

These rules establish requirements for computerized invoicing systems and technical specifications related to the generation and submission of invoicing records to the Spanish Tax Agency.

6. Vulnerability Reporting

Responsible Disclosure

If you discover a potential security vulnerability in Kuot, we ask that you report it to us responsibly before making it public.

Our commitment is as follows:

1. Acknowledgment of Receipt

We will acknowledge receipt of the report within a maximum of 5 business days.

2. Assessment

We will analyze the vulnerability and the associated risk.

3. Remediation Plan

We will communicate an action plan within a maximum period of 30 days.

4. Researcher Protection

We will not take legal action against security researchers acting in good faith, provided that they:

• Do not intentionally access third-party data.

• Do not alter other people’s information.

• Do not degrade or disrupt the service.

• Report the vulnerability to us responsibly.

5. Recognition

If the researcher wishes, we may publicly acknowledge their contribution on our acknowledgments page.

Security Contact

seguridad@kuot.online

7. Security Breach Notifications

If a security breach occurs that may pose a risk to users’ rights and freedoms, Kuot will notify the Spanish Data Protection Agency (AEPD) where required by law.

Where applicable, notification will be made within a maximum period of 72 hours after becoming aware of the breach, in accordance with Article 33 of the GDPR.

If the incident may pose a high risk to affected individuals, Kuot will also communicate it directly to them in a clear manner and without unnecessary technical language, in accordance with Article 34 of the GDPR.

8. Security Improvements in Progress

We prefer to communicate transparently about the measures we are working on rather than claim protections that have not yet been implemented.

Two-Factor Authentication (2FA)

Status: In development

We are working on adding two-factor authentication as an optional additional security measure for Kuot accounts.

Scheduled Backups

Status: In development

The automation and periodic scheduling of backups is planned.

Pending before publication: this statement must be aligned with the backup description included in Section 1.

Advanced Security Headers

Status: In development

We are working on deploying a stricter Content Security Policy (CSP) to strengthen protection against certain browser-based attacks.

9. Review of This Policy

This Security Policy is reviewed at least once a year.

It may also be updated when:

• Significant changes are made to our infrastructure.

• Applicable regulations change.

• New security measures are introduced.

• An incident occurs that requires us to review our procedures.

Internal Review Before Publication

This section must be removed from the public version.

• Confirm whether backups are currently automatic or only available on demand.

• If automatic, confirm the actual frequency and 30-day retention period.

• Verify the actual region of the Supabase project.

• Confirm exactly what “Vercel · EU” means for Kuot’s specific configuration.

• Verify the international processing carried out through the Gemini API.

• Confirm the Standard Contractual Clauses or other mechanism used for that transfer.

• Contractually confirm that documents submitted to Gemini through this configuration are not used to train models.

• Create and verify the operation of seguridad@kuot.online.

• Confirm that Kuot can realistically meet the 5-business-day and 30-day commitments stated in the Responsible Disclosure section.

• Verify that all technologies and security measures described match the current implementation.