Controls
Infrastructure security
Encryption in transit
In placeCriticalVerified 15 September 2026ST4S S1, S3, S5
What this control means
All traffic between users, the app, the API, the database and third-party providers uses TLS 1.2 or higher. Plain HTTP is redirected.
What we found
Every public host negotiates TLS 1.3 and refuses TLS 1.0 and 1.1.
How we verified it
- Connected to app.kuraplan.com, api.kuraplan.com and kuraplan.com with OpenSSL 3.6 from outside our network.
- Recorded the negotiated protocol (TLS 1.3) and cipher for each host.
- Forced TLS 1.0 and TLS 1.1 handshakes; all were refused.
- Confirmed plain HTTP redirects to HTTPS.
Still to do
- Publish SSL Labs reports per host.
- Screenshot the SSL-enforcement setting on the database connection.
Evidence (private, draft only): kuraplan-st4s-evidence/01-infrastructure/tls/2026-09-15-openssl-certs-and-protocols.txt
Questions about this control: security@kuraplan.com