Legal & Trust
Security Overview
How Klugliv protects household data — in plain language.
Security Overview
Last updated: 2026-07-20
This page is a plain-language summary of how Klugliv protects household data. It is written for users, partners, and reviewers. For more technical depth, see the Security Whitepaper.
What we protect
Klugliv processes information that can identify you or describe your household shopping, including:
- account identifiers (for example, email used for sign-in)
- receipt images and extracted purchase data
- shopping history derived from receipts
We treat this as personal data and design the product accordingly.
Security principles
| Principle | What it means in practice |
|---|---|
| Privacy-first | We collect what the product needs; we do not sell receipt data. |
| Least privilege | Services and people get the minimum access required to operate the platform. |
| Encryption | Data is encrypted in transit (TLS). Receipt storage on AWS uses encryption at rest (S3 with KMS). |
| No secrets in the app | OCR and infrastructure keys stay on the server — not in the mobile client. |
| User control | You can review OCR results before saving and delete individual receipts in the app. |
| Transparency | We document vendors, subprocessors, retention, and incident handling publicly. |
Architecture at a glance
Klugliv currently uses a hybrid stack:
| Layer | Provider (current) | Role |
|---|---|---|
| Mobile app | Expo / React Native | Capture, review, and display household data |
| Marketing site | Vercel | Public information (no receipt data) |
| Auth & database | Supabase | Sign-in and product data (Postgres + private storage) |
| OCR & media (migration slice) | AWS (eu-central-1) | API Gateway, Lambda, S3, KMS, Secrets Manager, CloudWatch |
AWS Cognito exists in our Terraform foundation for a future auth cutover; the mobile app still uses Supabase Auth today.
How receipt data flows (simplified)
- You upload a receipt from the signed-in mobile app.
- The image is stored privately (Supabase Storage; optional S3 dual-write when configured).
- OCR runs in a server-side AWS Lambda function — not on your device.
- The Lambda reads API credentials from AWS Secrets Manager (encrypted with KMS).
- Text extraction may use Google Cloud Vision (documented as a third-party processor).
- Parsed fields are shown for your review before they affect saved history.
Access control
- Mobile → API: requests use your Supabase session; the OCR Lambda validates the session before processing.
- Database: Supabase Postgres uses row-level security policies tied to your account.
- Storage: receipt buckets/objects are private — not publicly listable or readable.
- AWS IAM: Lambda and infrastructure roles are scoped to specific resources (for example, one secret ARN and its KMS key).
Logging and monitoring
- API and Lambda logs go to CloudWatch with configured retention (currently on the order of days, not years).
- We avoid logging full receipt content or unnecessary personal data in operational logs.
- AWS Budgets alert us to unexpected spend — a practical early warning for abuse or misconfiguration.
What we do not claim today
To stay accurate and honest:
- We do not claim ISO 27001, SOC 2, or similar certifications unless and until formally achieved.
- We do not operate a dedicated 24/7 security operations center at this stage.
- Account deletion in the app is still rolling out; contact us if you need help sooner (see Your Rights).
Incident handling
If something goes wrong, we follow the procedures in Incident Response, including assessment of whether regulatory or user notification is required.
Related documents
- Security Whitepaper — technical detail for security reviewers
- Trust Center — hub for privacy, security, and transparency
- Vendor Register and Subprocessors
- Data Retention Policy
- Privacy Policy
Contact
Security or privacy questions: hello@klugliv.com
If you believe you found a vulnerability, please include enough detail to reproduce the issue without sharing secrets.