DOC-02 // SEC

Security & Privacy

Data protection principles, operational controls, and exposure limits of the KENTODAL platform.

Information security visual concept

Trust Boundaries

Client BrowserWeb FormNo local storageOperating SystemProtocol (mailto:)Redirect to email clientNetwork & Providers (Third-party)Transport and Deliverykentodal.llc Inbox

Quote Data Handling

The platform implements a reduced-risk model where the KENTODAL web application does not store quote data on its servers. When a user utilizes the form:

  • The request is structured directly in the user's browser.
  • Transmission is delegated to the local email client via mailto:.
  • This minimizes application-side storage exposure by avoiding databases connected to the form.

The security of the message transmission will depend on the controls and transit encryption provided by both the user's email client and the receiving providers. The application does not guarantee end-to-end encryption or prevent interceptions in the email network.

Secrets Control

The source code separates configuration. Only strictly necessary variables (such as NEXT_PUBLIC_SITE_URL) are exposed to the client.

HTTPS Recommendations

For any production deployment, it is assumed that the platform must be served over HTTPS. This practice is essential to protect the integrity of the static files (JavaScript, HTML) delivered to the browser and to inhibit unauthorized alterations in transit.

Dependency Hygiene

The project maintains a small footprint of dependencies. The inclusion of invasive analytics libraries or third-party marketing tools that perform silent tracking has been avoided, prioritizing information sovereignty and technical simplicity.

Operations

Monitoring typically focuses on site availability and delivery performance. Given the absence of a transactional backend to receive forms, there are no application logs auditing the requests entered by users.