Trust
Security
A short, honest account of how Keizu is built to limit what a compromise could actually reach - not a checklist of claims.
Configuration notice: KEIZU_SECURITY_EMAIL is not set on this deployment, so the address below is a non-working placeholder.
Read-only by architecture
The application that serves this website connects to the database with a role that cannot write - not a permission Keizu chooses not to use, but one that doesn't exist for that connection at the database level. If the website were compromised, an attacker would get read access to public register data, not write access to anything.
Encrypted in transit
Connections to the database require TLS. The site itself is served over HTTPS with HSTS enabled, so a browser that has ever loaded it will refuse to fall back to plain HTTP.
No raw IP storage
Visitor IP addresses are never stored in raw form. Where an IP is needed at all - rate limiting - it's salted and hashed first, and the hashing refuses to run without a secret salt configured.
Parameterised queries, validated input
Every database query is parameterised; user input is never interpolated into SQL. Search input is normalised and validated before it reaches a query, and wildcard characters are escaped so a search box can't be used to bulk-export the underlying data.
No document resale, no data brokering
Keizu doesn't store or sell copies of source registry documents, and doesn't buy or blend in third-party data broker records. See Data sources.
Logging is stripped of personal data
Access logs are redacted of emails, IP addresses and credentials before they're written - logs are an easy place to accidentally create a second, unprotected copy of personal data, so that stripping happens automatically rather than by convention.
Where we are, honestly
Keizu is a young product. There is no formal penetration test or third-party security certification to point to yet, and we won't claim one. If you need that for your own vendor review process, ask - we'd rather have that conversation directly than let a badge imply something we haven't actually done.
Report a security issue
If you've found a genuine security issue, we want to hear about it before anyone else does.