our members trust you with their ID numbers, photographs and signatures. Kultiflo seals that data inside its own club, encrypts it on Google's infrastructure, and hands the keys only to the people you authorise — privacy you can audit, not just take on faith.
Built on Google Cloud.
POPIA-aligned by design.
Most systems put a single wall between tenants and hope nothing slips past it. Kultiflo enforces club isolation at three independent layers — if one ever failed, the next two still hold. One club's members, inventory and settlements have no path to another's.
Firestore security rules check your authenticated identity and your club against every read and every write before it touches the data. This runs on Google's infrastructure, not inside our app — there is no request that can talk its way around it, and no admin screen or backdoor that exposes one club to another.
Every query the apps make is scoped to your club's ID before it leaves the device. Another club's data is never requested, never returned, never cached. The app simply has no question it can ask that would surface it.
The interface only ever assembles the club you are signed in to. Even if the layers above were somehow bypassed, there is no screen, list or report in the product that is built to display another club's members or records.
Kultiflo runs on Google Cloud — Firebase and Firestore — the same platform behind Google Workspace, with automatic redundancy and failover across multiple data centres. We don't run our own servers, and we don't ask you to trust ours.
Your members' data sits in Google Cloud, which is independently audited and certified against the standards below. These certifications are held by Google Cloud as Kultiflo's infrastructure provider — the same security posture that protects billions of users worldwide.
Every connection between the apps and the backend travels over TLS 1.2+ (HTTPS) — the same standard that protects online banking. Data stored on Google Cloud is encrypted at rest with AES-256, with keys managed by Google's Key Management Service and held separately from the data they unlock.
Identity is verified by Firebase Authentication, not a home-grown login. Your club decides who holds which role, and the system holds them to it.
Members and staff sign in through Firebase Authentication. Multi-factor authentication can be switched on for a second verification step, and biometric unlock — fingerprint or face — is available on supported devices, so a borrowed phone is not an open door.
Firebase App Check verifies that requests come from the real Kultiflo apps before they reach the backend, turning away bots, scrapers and spoofed clients that try to imitate them.
Every action is gated by role — admin, front desk, POS operator, farmer. People see and do only what their role allows. And sensitive actions — voids, stock removals, member approvals, settlements — are written to an audit trail that records who did what, and when.
Some protections are technical. These are commitments.
POPIA gives every member rights over their personal information. Kultiflo is built to honour them — not to hold data hostage.
Before a member is registered, four consents are recorded against their profile — terms, privacy, data processing, and (optionally) marketing — each linked to the live document they agreed to, with the timestamp. Lawful processing isn't an afterthought; it's step one of onboarding.
Members may ask to see, correct, or delete the personal information held about them, and those requests are honoured under POPIA. Deletion is handled on request through your club — not buried behind a form designed to make you give up.
Only approved staff can reach production data, and only to resolve a problem that's been reported — never to browse. The system is built so that we rarely need to look at a member's data at all.
On candourWe'd rather show you how the system is built than quote a track record. Kultiflo is young — our case for your trust is the architecture on this page, and every layer of it reflects how the apps actually work. If something here matters to your members, ask us to walk you through it.
Email our team → Read the full Privacy & POPIA policy →