Compliance overview
Understanding your compliance obligations.
Overview
Running an online jewelry store comes with legal and regulatory obligations. Katura provides built-in tools to help you stay compliant with data privacy laws, payment security standards, and accessibility requirements.
PCI compliance
You're automatically PCI compliant when using Katura with Stripe. Here's why:
- Katura never stores, processes, or transmits credit card numbers
- Payment forms are rendered by Stripe's secure Payment Element
- Stripe is a PCI Level 1 Service Provider (the highest level)
- Card data goes directly from the customer's browser to Stripe's servers
Data privacy
Katura takes data privacy seriously:
- Data storage — Customer data is stored in Supabase (PostgreSQL) with encrypted connections
- Error monitoring — Sentry is configured with privacy-conscious settings
- Audit trail — Admin actions are logged for accountability
- Role-based access — Only authorized team members can access sensitive data
Audit logging
Katura maintains audit logs for compliance and accountability:
- Employee audit log — track team member actions at Employees → Audit
- System audit — general audit trail at Admin → Audit
- Vulnerability scanning — proactive security monitoring
Warning
If you sell to EU customers, ensure you have a cookie consent banner and a GDPR-compliant privacy policy. These are your responsibility as the store owner.
GDPR & CCPA
Katura ships the building blocks you need to satisfy GDPR (EU) and CCPA/CPRA (California) obligations. The platform-side responsibilities are ours; the policy and disclosure obligations are yours.
| Requirement | Katura provides | You provide |
|---|---|---|
| Right to access | POST /api/admin/customers/[id]/export — full data dump as JSON | Process for honoring requests within 30 days |
| Right to erasure | DELETE /api/admin/customers/[id]?mode=erase — anonymizes PII while preserving order ledger for tax/audit | Verify identity before erasing |
| Right to portability | JSON + CSV export formats | Deliver to requester |
| Consent records | Cookie banner, marketing consent flags, timestamp + IP captured per consent change | Decide what categories you ask consent for |
| DPA | Standard DPA available at /legal/dpa; signable in-app via DocuSign | Counter-sign and store |
| Sub-processor list | Maintained at katura.com/legal/subprocessors; we email when we add one | Disclose in your own privacy policy |
Data residency
Default region is us-east-1. EU and UK regions are available on the Enterprise plan with database, file storage, and Brevo sending all pinned to the chosen region. Cross-region replication is opt-in for disaster recovery.
Audit log retention
Audit log entries are append-only and retained for 7 years by default (the longest US federal record-retention requirement for accounting). The Owner can adjust at Settings → Compliance → Retention within the allowed range (1–10 years).
Security posture
- TLS 1.2+ enforced on every endpoint; HSTS preloaded
- Database connections require TLS; row-level security via Supabase RLS
- Secrets managed via Vercel Encrypted Environment Variables, never in source
- Continuous vulnerability scanning via GitHub Advanced Security
- Quarterly penetration testing on the Enterprise plan
- SOC 2 Type II in progress — current report status at
katura.com/trust
Incident response
Suspected data incidents go to security@katura.com (PGP key on the same page). We commit to acknowledging within 4 hours, preliminary scope within 24 hours, and notifying affected tenants within 72 hours per GDPR Art. 33 timing.