Kodo Portal security and backups

Alongside your password, you can protect your account with a six-digit code from an authenticator app. Kodo administrators must use a second factor. Clients and partners can enable it in their account settings.

After signing in, open Account security, add an authenticator app and confirm the first code. You can use Microsoft Authenticator, Google Authenticator or 1Password, for example. You can add a second authenticator in case you lose your phone. Resetting your password does not disable the second factor.

Permissions determine which companies, cases and files each account can see. We keep client files in private storage. The portal checks permission for each document before creating a download link. The link expires after a limited time.

Partners have access to the companies assigned to them, within the permissions of their role. Assigning a client to a partner does not give the partner access to private correspondence between that client and Kodo. HTTPS encrypts the connection between your browser and the portal.

Documents that can be deleted in the portal go to the trash first. Contact us if you delete a document by mistake. A Kodo administrator can access the trash and put it back where it was.

When a company is removed from the active list, the portal keeps its documents and history. Contact us if it was removed by mistake.

• Portal database. Supabase takes daily automatic backups of records such as company details, case statuses and links to documents.
• Client files. We store daily copies in private Cloudflare R2 storage, separate from where we normally work with the files. When a file changes, the backup keeps a new version. We can use the backup index to locate a specific document or an earlier version.

We host the website on Vercel, use Supabase for the portal database and primary storage, and keep file backups in Cloudflare R2.

In a recovery test, we restored selected files to a separate environment and checked that their checksums matched the originals. This gives us a tested way to retrieve an individual document when needed.

When we change sign-in or document features, we check how the portal behaves for each role. We also review security advisories for the software we use and test updates before deploying them.

We use client data as needed to deliver the services agreed with you, operate them securely and meet legal obligations. Infrastructure providers may process the information they need, and relevant authorities and collective compliance schemes may receive it where necessary. We do not sell client data or share it with third parties for their own marketing.

Contact us if you lose access to your authenticator app, need to find a document, or notice unusual activity on your account. Tell us which company or case is involved and briefly explain what happened. Keep your passwords and verification codes private.