Security

At Kalshi, we take customer data and privacy protection seriously. We must! As a United States (US) Federal Government regulated financial exchange, we are compelled to meet the standards set forth by the US Federal Government. Our regulator is the CFTC, the Commodity Futures Trading Commission. The stated mission of the CFTC is to promote the integrity, resilience, and vibrancy of the U.S. derivatives markets through sound regulation. We are the only exchange solely dedicated to event contracts that must comply with Federal regulation safeguards - to protect you, your money, and your information, and to ensure a fair playing ground for everyone on Kalshi.

The security measures we adopt are similar to the measures adopted by other financial institutions like banks, broker-dealers, and major Wall Street stock exchanges. It almost goes without saying that the US bank and financial institution security measures are some of the strongest in the world. In general, our security guidelines are taken from the National Institute of Standards and Technology (NIST) Special Publication 800 series papers. Don't worry, though, we have read them so you don't have to.

Secure Infrastructure (Secure by Design)

We deploy our platform in line with the security and privacy requirements and expectations of a regulated entity and best practices of industry using the latest cloud-native architecture on Amazon Web Services (AWS). Our deployments use the well-respected Cloud Native Computing Foundation (CNCF) products and methods with the containerized workloads - no Operating Systems (OSs) here! Containers are so hardened against attack that they are well known to reduce the "attack surface" (software and features to attack) compared to a general-purpose OS. Don't believe us? NIST SP 800-190 will give you the low-down.

Access control (We are the Knights Who Say "ni")

All employee accounts are protected by strong passwords and multi-factor authentication (MFA). We have implemented the federally required least privilege and separation of duties. We use a secure identity source and do not rely on the most targeted platforms like Windows Active Directory. If a Kalshi employee is phished or otherwise compromised, there is little chance that one machine will infect the other Kalshi employees or our AWS platform.

Data Security (Encrypt all the things!)

Data is protected with proven data encryption, applied ubiquitously across our platform. We employ data masking and data anonymization wherever needed to protect privacy and allow our developers to do their jobs. Customer data is separated into multiple databases, further limiting the "blast radius" of a breach. A single database breach would not expose our customer data in an identifiable way. Access controls and encryption keys are both separate from the databases. We will manually remove all data associated with your account from our database upon request.

Secure Development

Kalshi uses secure development practices and modern methodologies like git, code reviews, Continuous Integration (CI). The most secure development lifecycle practices available to us are just another part of our "defense in depth" approach, which is widely recommended by all security authorities.

Email Security (I got something for ya)

Vulnerability Management (I can fix that!)

Disaster Recovery (and it's gone!)

Compliance (why don't you do right?)

Incident Response

Third Party Security