Security
Udala is built with security-first engineering. Here is how we keep your data safe.
📅 This feature launches with Udala v1.0 in January 2027. Join the waitlist for early access.
Authentication
- Password hashing: bcrypt with cost factor 12
- Two-factor authentication: TOTP (Google Authenticator compatible) - available on all plans, enforced on Enterprise
- Session security: HTTP-only, SameSite=Strict cookies; sessions invalidated on logout
- CSRF protection: All state-changing requests require a CSRF token
Data security
- In transit: TLS 1.3 minimum on all connections
- At rest: AES-256 encryption on Hetzner storage volumes
- Backups: Daily automated backups, encrypted, retained for 30 days
- API keys: Hashed before storage - we never see your key after creation
Access control
- Role-based access control enforced at the application layer
- Row-level tenant isolation enforced at the database layer
- All admin access to tenant data requires explicit authorisation and is logged
Audit trail
Every create, update, approval and deletion in Udala is logged in an immutable audit trail with timestamp, user, action and before/after values. The audit trail cannot be edited or deleted, even by workspace Owners.
Vulnerability disclosure
Report security vulnerabilities to security@udala.africa. We respond within 24 hours and will work with you on responsible disclosure.