Private membership
There is no public directory and no browsing. Registration is by invitation, and an invitation grants the right to register, and nothing else. It does not verify anyone and does not vouch for them.
Security
How the network is built, in enough detail to judge it. We describe what we do; we do not claim to be unbreakable, and we hold no security certification.
Identity verification
Every member completes identity verification before they can publish a request or ask for an introduction. Verification is reviewed by a person, and the architecture is built so an external verification provider can take over that step without changing anything else.
Restricted communication
You cannot message a member you are not connected to. Connections exist only where both people accepted an introduction, and the server enforces that on every message, not the interface.
Data minimisation
We ask for what an account, verification, matching, safety, and communication need, and stop there. We do not ask for bank details, account numbers, or proof of funds, because the platform has no part in any money.
What other members see
Your initials, whether you are verified, your corridor, your amount range, and your timing. City, time as a member, and completed-connection count are each a switch you control. Your full name, email, phone, address, date of birth, and documents are never shown to another member.
Identity documents
Documents are stored in object storage that is not publicly reachable, are never given a public URL, and are never referenced from a profile. Only staff holding an explicit document-review capability can open one, every view is logged against that person, and documents are deleted on a retention schedule after a decision.
Encryption in transit
All traffic runs over HTTPS with HSTS. Session cookies are HttpOnly, Secure, and SameSite=Strict, so they are not readable by scripts and are not sent on cross-site requests.
Account security
Passwords are stored as salted PBKDF2-SHA256 hashes with a high iteration count, never in any recoverable form. Two-factor authentication is available. You can see every device signed in, sign out of all of them at once, and read your own recent security history. Changing your password signs out every other device.
Access controls
Staff access is granted as named capabilities rather than a blanket admin flag, so reading the verification queue, opening a document, reading a reported conversation, and changing someone's role are each separately granted. Every check runs on the server; hiding a button is never the control.
Audit logging
Sensitive actions, including verification decisions, account status and role changes, document views, settings changes, and staff reads of member data, are written to an append-only audit log with the actor, the target, the time, and a reason. Nothing in the application updates or deletes those rows.
Abuse reporting
Every profile, request, and conversation can be reported, and members can block each other. Reports reach a queue that a person works through. Automated triage may suggest a priority; it never takes an action.
Rate limiting and bot protection
Registration, sign-in, password reset, invitations, request creation, introductions, messages, and reports are all rate limited on the server. Public forms are protected by a bot challenge.
What we do not claim
No system is completely secure, and we will not tell you otherwise. We hold no SOC 2 report, no ISO certification, and no PCI attestation, and nothing on this page should be read as one.
Verification confirms an identity. It does not make someone honest. The most important protection on this network is your own judgement about who you choose to deal with.
Found a security problem? Write to hello@kodefoundry.com with enough detail to reproduce it. We will acknowledge you and we will not pursue anyone acting in good faith.