Skip to content
GitHubDownload

Trust center

Security, updates and your data.

How Kaleta handles vulnerabilities, updates, privacy and your data – with links to the policies and the public record on GitHub.

Security policy.

Report a vulnerability privately on GitHub or to info@kaletacms.com. We reply within three working days and usually release a fix within 14 days; critical issues are fixed as soon as possible.

Read the policy

Security advisories.

After a fix is released, we publish a GitHub Security Advisory with a description and credit to the reporter.

Advisories on GitHub

Signed updates.

Every package is signed with Ed25519 on the publisher’s machine, never in CI. A site verifies the signature and the checksum, backs up the database and rolls back if anything fails.

How updates work

Supported versions.

The latest release is supported, and every version from 1.2 on reaches it in one step, as long as the server runs PHP 8.3 or newer. Nothing is removed without at least two minor releases and six months of notice. Security releases install themselves unless the administrator turns off automatic security updates.

Release policy

Privacy by design.

No third-party scripts or fonts, statistics without cookies, and enquiries and cookie consent records deleted after a period the administrator sets – 24 and 36 months by default.

Privacy policy

Your data.

Export the whole site at any time and import it into another Kaleta installation. Database backups run every day something changed; add an FTPS or S3 target and they go off the server together with the media. A restore is checked before it replaces anything.

Security features

Releases

How a release is made.

  • Open source – the code is public on GitHub under the GNU GPL, version 2 or later.
  • Tested – every release runs the full test suite on GitHub Actions, including upgrading an old database on MySQL and MariaDB.
  • No third-party PHP libraries – the only bundled third-party code is Leaflet for maps, served from your own site.
  • Public record – releases, changes and advisories are published on GitHub in English.

Found a vulnerability?

Please report it privately rather than in a public issue.

Write to info@kaletacms.comReport on GitHub