Security
Private family history deserves careful protection.
Last reviewed 27 July 2026. Kinonicle uses layered access controls and reviewed changes during its private beta. This describes current safeguards, not a certification or a claim that security risk can be eliminated.
Individual access
Family spaces use invited email accounts and short-lived verification codes rather than a shared family password. Sessions are held in secure, HTTP-only cookies. Members can sign out one device or revoke refresh access across all devices.
Family boundaries
The server derives the family context and checks an active membership on every protected request. PostgreSQL row-level security provides a second boundary, and the application database role cannot bypass it.
Steward protection
Imports, exports, approvals, history and member-management operations require steward authorization and authenticator verification. A steward can suspend a member immediately when access may be compromised.
Private records and uploads
GEDCOM files and photographs are validated, size-limited and stored privately under opaque identifiers. Private family routes are excluded from search indexing and responses are marked not to be cached.
Change history and recovery
Security-relevant family actions are attributable to individual accounts in append-only audit history. Automated checks cover permissions, request validation, committed secrets, dependencies, database isolation and restoration from backup.
Responsible beta limits
The live two-family isolation, session-revocation, account-recovery and backup-restoration gates have passed with synthetic data. Real family import remains paused for family consent and a final private-beta review. No family should use the beta as its only archival copy.