Security & Responsible Disclosure

Last updated: May 9, 2026

Our security commitment

Keigo handles user data including emails, payment info (via Stripe), uploaded documents (visa, tax, ID), and AI conversation history. We take security seriously and welcome reports from researchers who help us protect our users.

How to report a vulnerability

If you believe you've found a security issue, please email us privately rather than disclosing publicly. We aim to respond within 48 hours, triage within 5 business days, and remediate based on severity.

GPG key available on request. Please include reproduction steps, affected URLs, and your handle if you'd like credit.

In-scope (please test)

Authentication flow, session handling, account lockout, password reset

Stripe checkout & webhooks, subscription state, plan gating

S3 document upload/download, presigned URL handling, ZIP export

Out of scope (please don't)

DoS / DDoS / volumetric attacks (we use rate limiting and that's expected; deliberately overloading is forbidden)

Social engineering against employees, contractors, or end users

Physical attacks on infrastructure or office locations

Reading data from other users' accounts (use your own test account; if you've accessed someone else's data accidentally, report immediately and delete)

Our commitment to you

We will not pursue legal action against researchers who follow this policy in good faith, who don't access more data than necessary to demonstrate the issue, who give us reasonable time to fix before public disclosure (90 days standard), and who don't use the issue to harm Keigo or its users.

Credit & rewards

We're a small team without budget for a formal bug bounty program yet. We do offer:

— Public credit on this page (with your consent) for confirmed unique vulnerabilities

— A free lifetime of The Vault of your Keigo account

— Honest gratitude — your work directly helps the foreign community in Japan stay safer.

How your documents are protected

Encrypted at rest (AES-256) on servers in Tokyo

Encrypted in transit over HTTPS/TLS

Opened through private, time-limited links — never public

Each account's files are isolated from every other account

Photos you analyze with Snap & Sort are not kept after analysis