Security

Cancel Desk is operated by Klair Technology Solutions Private Limited (Klair Labs), Hyderabad, India. This page describes how the service actually stores and protects data — what is in place today, and, at the bottom, what is not. If a security page and reality ever disagree, tell us at hello@klairtech.com and we'll fix whichever one is wrong.

Where data lives

All account, flow, and session data is stored in Amazon Web Services' Asia Pacific (Mumbai, ap-south-1) region, in DynamoDB. DynamoDB encrypts all data at rest with AWS-managed keys — this encryption is always on and cannot be disabled. All traffic between your browser and Cancel Desk travels over TLS, terminated at Amazon CloudFront. CloudFront caches and serves pages from edge locations worldwide; it does not store account or session data.

Isolation from other Klair Labs products

Cancel Desk runs isolated from our other products: its own DynamoDB tables, its own Lambda function, its own IAM role, and its own signing secrets. A fault or compromise in a sibling product (DSAR Desk, the klair.in tools) does not reach Cancel Desk's data, and vice versa.

Who can access production

One person — Sandeep Kavety, the founder — has AWS and production access. There is no wider team, so there is no wider access list to manage, and equally no pretence of separation of duties: the person who writes the code is the person who operates it. We say this plainly because it's the true trade-off of a solo-operator product, and you should weigh it.

How sign-in works

• No passwords. You sign in with a one-time magic link emailed to you. There is no password for anyone to phish, reuse, or crack — but this makes the security of your email account the honest dependency: anyone who can read your email can sign in as you. Protect that account (strong password, two-factor) and tell us immediately if it's compromised.
• Signed session tokens. Your signed-in session is an HMAC-signed license token; the server verifies the signature on every request.
• API keys are stored as SHA-256 hashes only. The raw key is shown once at generation time and never stored — we cannot recover it, only verify it.
• Outbound webhooks are signed. Every webhook delivery carries an X-CancelDesk-Signature header — an HMAC-SHA256 of the raw body using your workspace's secret — so your endpoint can verify a payload actually came from us.

Backups

Point-in-time recovery is enabled on all Cancel Desk tables (as of 26 August 2026). It lets us restore a table to any second within the last 35 days — protection against operator error and bad deploys, not just hardware failure.

The audit trail cannot be quietly edited

Account and flow actions are written to an append-only audit table. The table's IAM policy carries an explicit Deny on UpdateItem, DeleteItem, and BatchWriteItem — even the application's own role cannot alter or remove an audit row once written. The Audit tab in your dashboard shows this trail (Free: last 30 days; Pro and Premium: full history).

The flow itself is never blocked

A design decision worth stating on a security page: the public cancel flow always completes. Past the free tier's 25 recorded sessions a month, the customer's cancellation still goes through and the merchant is still emailed — only dashboard recording is skipped. No plan limit, billing state, or quota ever stands between a customer and cancelling.

If something goes wrong

If we become aware of a security incident affecting customer data, we will acknowledge it within 48 hours and notify affected customers by email without undue delay, with what we know, what we've done, and what (if anything) you should do. Incidents are also noted on our status page and in the legal changelog.

Reporting a vulnerability

If you find a security issue in Cancel Desk, email hello@klairtech.com with enough detail to reproduce it. It goes straight to the person who can fix it. We'll acknowledge within 48 hours. We don't run a paid bug bounty (see below), but we will credit you if you'd like, and we won't take action against good-faith research that avoids accessing other people's data.

What we have not done yet

When any item on that list changes, it moves out of this section and gets a dated entry in the changelog.