Security

Operator of the KADOSH product at kadoshworshipband.com · Last updated: October 6, 2026

Content and rights. KADOSH does not sell or grant licenses to user materials. Private assets are served only with authorization.

1. Approach

KADOSH serves private assets only after authorization. API routes require authentication (or a valid share token where a leader has enabled one). The application database is not exposed as a public internet service. Public access uses HTTPS. Organization, song, event, invitation, role, and permission checks isolate material. Direct public download of private files is blocked where the product can enforce it. Asset and chat-attachment URLs are not permanent public links.

2. Your responsibilities

Protect account credentials and do not share accounts.
Invite only trusted collaborators.
Do not redistribute private rehearsal files outside the product unless authorized.
Do not evade permissions or technical controls.

3. Reporting

A dedicated security email has not yet been designated. Use the Contact page and avoid public disclosure of an unfixed issue until we can respond.

4. Screenshots and capture

KADOSH does not claim that screenshots can be blocked on every platform. Contractual prohibition applies. Native screen-protection APIs can be enabled later on compatible platforms without changing the permission model. External camera captures cannot be fully prevented.

5. Chat

Chat messages are delivered in real time only to current members of that thread. Attachments are stored privately and served only to current thread members. A reference to a score or track is re-checked against project or event membership each time it is opened. KADOSH uses moderation and security systems and may log hidden messages and related security events. The UI may not announce every alert. Native push (iOS/Android) is not configured until the operator enables it; in-app and browser notices still require the app or tab to be open.