Trust center
Security, updates and your data.
How Kaleta handles vulnerabilities, updates, privacy and your data – with links to the policies and the public record on GitHub.
Security policy.
Report a vulnerability privately on GitHub or to info@kaletacms.com. We reply within three working days and usually release a fix within 14 days; critical issues are fixed as soon as possible.
Read the policySecurity advisories.
After a fix is released, we publish a GitHub Security Advisory with a description and credit to the reporter.
Advisories on GitHubSigned updates.
Every package is signed with Ed25519 on the publisher’s machine, never in CI. A site verifies the signature and the checksum, backs up the database and rolls back if anything fails.
How updates workSupported versions.
Only the latest release is supported. Sites check for updates twice a day and install security releases on their own unless the administrator turns it off.
ChangelogPrivacy by design.
No third-party scripts or fonts, statistics without cookies, and enquiries and cookie consent records deleted after a set period.
Privacy policyYour data.
Export the whole site at any time. Database backups run automatically, also off-server over FTPS or S3, and a restore is checked before it replaces anything.
Security featuresReleases
How a release is made.
- Open source – the code is public on GitHub under the GNU GPL, version 2 or later.
- Tested – every release runs the full test suite on GitHub Actions, including upgrading an old database on MySQL and MariaDB.
- No runtime dependencies – the system uses no third-party libraries at runtime.
- Public record – releases, changes and advisories are published on GitHub in English.
Found a vulnerability?
Please report it privately rather than in a public issue.