Current verified controls
- The website and applications are served over HTTPS, which encrypts information in transit between a supported browser and the service.
- The Contact form verifies Cloudflare Turnstile tokens on the server, checks the request origin and hostname, applies reasonable edge request limits, validates every field again on the server, and sends accepted messages through Resend.
- Contact messages are not stored in a Kernvale database. The private receiving address and service credentials remain in the server environment.
- Current product access is owner-only and uses platform-managed ChatGPT authentication.
- Ship Ledger, Money Ledger, and SearchLedger data operations require an authenticated platform user ID.
- Stored records are queried and changed using that authenticated user ID to separate one user’s product records from another’s.
- Cloudflare provides application hosting and D1 database storage.
- Destructive product-data actions require a clear confirmation. Ship Ledger and Money Ledger provide full data-deletion controls.
- Credentials and private configuration are handled through the hosting environment rather than exposed in website code.
Product-specific safeguards
Ship Ledger
Task, idea, and focus-session reads and writes are scoped to the authenticated user. Full deletion removes that user’s tasks, including dropped records, details, notes and checklists, plus ideas and focus-session history. The device-local focus timer is explained and can be cleared separately.
Money Ledger
The active ledger and retained history states are associated with the authenticated user. Full deletion removes both. Replacing preview information with a real ledger clears retained preview history first. Money Ledger uses manual entry and does not store bank-login credentials or payment information.
SearchLedger
Saved audits are associated with the authenticated user. URL retrieval permits public HTTP and HTTPS webpages, validates resolved destinations and redirects, blocks private and local network destinations, limits request time and response size, and accepts HTML webpage content. Users must confirm authorization to analyze submitted URLs.
Kernvale does not currently use advertising tracking or active product analytics. The products do not process payments.
Limited administrative access
Kernvale personnel may access user records only when reasonably necessary for support, troubleshooting, security, legal compliance, or protecting the service. Infrastructure providers may process information needed to operate, secure, and deliver their services.
Provider-controlled authentication, delivery, and operational logs may follow practices and retention periods that Kernvale does not directly control.
Practical limits
No system can guarantee absolute security or continuous availability. Kernvale does not claim bank-level security, military-grade security, or that every risk can be eliminated. Users should protect their ChatGPT account and device, review entries and product output, and report unexpected behavior promptly.
Security practices will be reassessed before broader registration or material new features such as payments, bank connections, uploads, collaboration, analytics, advertising, or international access.
Report a security concern
Submit a security concern through the Kernvale Contact page. Identify the affected product or page, what you observed, when it occurred, and a safe way to contact you. Please do not publicly disclose sensitive details, credentials, personal information, or a working exploit while we review the report.
We will acknowledge and investigate credible reports as reasonably practical. Do not test against accounts, records, or systems you do not own or have permission to assess.