KesherSecurity and club independence
Kesher holds a club's roster, its contact details and its money records. Everything below describes what the software does today — nothing on this page is aspirational.
Getting in
There are no passwords to steal
Sign-in is a one-time link sent to an email or phone, or a passkey — Face ID or Touch ID on the member's own device. There is no password store, so there is nothing to leak in a breach and nothing to reuse from somebody else's.
Links work once
Twenty minutes, single use, and stored hashed rather than in the clear.
Sessions are HttpOnly
No script can read a session cookie, so a scripting bug cannot steal one.
Passkeys are per device
The private key never leaves the phone and we never see it.
Sign out everywhere
One action ends every session on every device.
The important one
One club cannot reach another
Every request resolves which club it is acting in, and every query is filtered by it. An officer of one club has no path to another club's roster, money or posts — not a permission they lack, but no route at all.
We test this from the second club's point of view on every change, because the first club's view looks correct whether or not the code is. That distinction has caught real bugs here.
Kesher's own staff
Platform administrators can create a club, hand it to its officers, and see which clubs exist and who belongs to them. They cannot see a club's roster details, dues, posts or photos. The same rule applies to an alliance.
Inside a club
Officers get their job, and only their job
Permissions are named after the work: recording dues, approving members, managing rides, moderating the feed. A treasurer can keep the books without being able to admit anyone.
Members control their own visibility: contact details can be hidden from the rest of the club, and nobody outside a member's own clubs can find them unless they switch that on. It is off by default.
Under the hood
What is actually in place
Row-level security on
Enabled on every content table, with no public read policy. The browser's key cannot read club data at all.
Photos are private
Stored in a private bucket and served through short-lived signed links, never public URLs.
Content Security Policy
A fresh nonce per request, so injected script does not execute.
IP addresses are hashed
Used for rate limiting and abuse. We do not store the address itself.
Rate limiting
On sign-in, sign-up, posting and the public forms.
Append-only audit
Who changed access, money or content. No edit or delete path exists in the app.
Traffic is encrypted in transit. The database and file storage are run by Supabase and the application by Railway, both in the United States; encryption at rest and backups are theirs, and we have not audited them independently — so we describe them as their providers do rather than making a promise of our own.
Leaving, and being honest
Your data comes with you
Any officer can export everything the club holds — roster, rides, RSVPs, announcements, feed, photos, dues, expenses and the club's own audit trail — at any time, without asking and without paying.
What we have not done
No independent penetration test or security audit. No SOC 2, and no bug bounty. Kesher is young and run by riders. If you find something, tell us on the contact page and we will fix it and say so — that is worth more to us than a badge.