Security Architecture & Cryptographic Model

Family finances represent sensitive personal data. Kestro implements defense-in-depth across mobile hardware, cloud transport, and transactional database constraints.

1. Transit Cryptography (TLS 1.3)

All communications between Android devices, edge servers, and our Supabase backend are encrypted strictly via TLS 1.3. Deprecated protocols (TLS 1.0, 1.1) and legacy cipher suites are rejected at the edge.

HSTS: max-age=63072000; includeSubDomains; preload

2. Database Encryption at Rest (AES-256)

Database volumes, write-ahead logs (WAL), and point-in-time backups are transparently encrypted using AES-256. Storage keys are managed through isolated hardware security modules (HSMs).

AWS KMS / Supabase Managed Master Keys

3. Android KeyStore & Biometrics

Local on-device SQLite caches are protected with AES keys generated inside the hardware-backed Android KeyStore (TEE / StrongBox). Access requires valid BiometricPrompt authentication.

KeyGenParameterSpec.PURPOSE_ENCRYPT | PURPOSE_DECRYPT

4. Database Step-Up TOTP MFA

Destructive administrative procedures call platform_require_recent_mfa(300) inside PostgreSQL, verifying that a TOTP challenge occurred within the last 300 seconds before executing.

auth.jwt() -> 'amr' • Raises P0001 / P0002 on stale session

Regulatory Compliance

Indian Digital Personal Data Protection Act, 2023

Kestro operates as a compliant Data Fiduciary. Users enjoy full statutory rights to access personal records, export complete ledger histories in open standard formats (CSV/Excel), and execute irrevocable permanent account deletion.