FAQ
Frequently asked questions
Sixteen straight answers about what Kharazm does, how access and permissions work, what protects a workspace, and what has not been built yet. If your question is missing, write to us and we will answer it — and probably add it here.
The basics
What is Kharazm?
Kharazm is a focused, multi-tenant program-management platform. A workspace holds programs with owners, dates, objectives, tasks, milestones, and risks and issues.
The same data powers board, list, timeline and workflow views, reports, manager-recorded program health, and weekly updates that can be published to read-only in-workspace history. It is a hosted web application, not something you install.
Who is Kharazm for?
Kharazm is for teams accountable for multi-step programs and regular stakeholder reporting.
That can include cross-functional delivery teams, government and nonprofit programs, grant-funded initiatives, operational change, community programs, and learning and development. It is most useful when a team needs shared ownership, visible risk and a defensible record of status without a configuration-heavy portfolio suite.
What is the difference between a program, a task and a milestone?
A program is the whole effort — for example a launch, rollout or learning program — with an owner, start and end dates, an objective, progress and a health rating. Programs can be created, edited, archived and deleted, and grouped into portfolios.
A task is a piece of work inside a program. It carries a status, priority, assignee, due date, labels, a blocked flag and chronological comments.
A milestone is a dated checkpoint that marks progress rather than holding work of its own, and it appears as a diamond on the timeline.
To do In progress Review Done
Access, roles and your team
How do I get access, and why does a new workspace need approval?
A signed-out person's initial registration request creates a pending workspace request that an operator reviews. Once approved, the requester can sign in. A colleague's invitation to an existing workspace bypasses that queue.
An already signed-in user can also create an additional workspace immediately. Initial review reduces automated signups, but it is not identity verification or approval of every tenant.
What are the four access levels and what can each one do?
Admin, manager, member and viewer, in that order of privilege.
| Role | What it can do |
|---|---|
| Admin | Create and delete programs, manage the people in the organization, and read the audit log — plus everything below. |
| Manager | Create and delete tasks, and manage programs and milestones — plus everything below. |
| Member | Edit tasks, change status, and comment. |
| Viewer | Read-only. Suits stakeholders who need visibility but should not change anything. |
Every one of these checks runs on the server, using the identity from your session rather than anything the browser sends. Hiding a button is never the only thing standing between a role and an action.
Can I invite my team, and how do invitations work?
Yes. An admin creates an invitation for a specific email address and assigns the role at the same time. The token is stored only as a SHA-256 hash, expires after seven days, can be revoked, and can be accepted once by that email address.
If transactional email through Resend is configured, the link is emailed; otherwise the admin can share the generated link securely. A new or existing account can accept it without entering the initial-registration approval queue. Roles can be changed later, and membership changes create organization audit entries.
What happens if I forget my password?
When transactional email is configured, use the reset flow from the sign-in screen. Kharazm emails a single-use link valid for one hour; only a SHA-256 hash of the token is stored.
Setting a new password revokes every existing session. The forgot-password endpoint returns an identical response whether or not an account exists. Without configured email delivery, a reset message cannot be delivered and the operator must restore access through a separate support process.
Security and privacy
Is my organization's data isolated from other organizations?
Yes. The organization is the intended security boundary in Kharazm. Server queries and writes are scoped to the organization on the authenticated session, and automated tests cover cross-tenant isolation.
Cross-tenant isolation is covered by automated tests. Most state-changing operations create a per-organization audit entry visible only to admins; the log records an actor, operation, summary and time, not field-level diffs.
What security protections are in place?
The short version:
- Passwords hashed with scrypt and a per-user random salt, verified in constant time
- Sessions as 32-byte opaque tokens; only the SHA-256 hash is stored
- httpOnly, SameSite=Lax session cookie that is Secure in production and expires after 14 days
- Permissions enforced server-side, with the actor taken from the session
- HTTPS enforced with HSTS, plus a strict Content-Security-Policy, X-Frame-Options DENY, nosniff, a same-origin referrer policy and camera, microphone and geolocation switched off
- CSRF defence from SameSite cookies plus a same-origin guard on state-changing requests
- Bounded, instance-local rate limiting on authentication and high-impact authenticated write routes
- Strict discriminated Zod schemas for all 27 supported domain writes, including operation-specific IDs, enums, dates, text lengths and arrays; unknown keys are rejected
Known gaps are published rather than hidden: no self-serve account or organization deletion in the interface, backup guarantees that depend on the database plan, instance-local rather than distributed rate limiting, and no third-party penetration test.
Does Kharazm use trackers, analytics or third-party integrations?
No third-party analytics, trackers or advertising technology run in the browser. The web font is self-hosted, and the Content-Security-Policy restricts browser connections to the application's own origin.
There are no product integrations or AI/agentic features today. Kharazm does not connect to Slack, Microsoft Teams, Workday, an LMS, a model provider or other work systems. AI and agentic assistance is a roadmap workstream, not a current feature.
The server uses Fly.io and Neon, plus Resend when transactional email is configured. Without email, invitation links can be shared manually, but password-reset and approval messages cannot be delivered.
Data stored is minimal by design — your account email, display name, organization membership and role, and the program data your team creates.
Using Kharazm day to day
What do the Timeline and Workflow views show?
Timeline is a Gantt-style due-date visualization with month gridlines, a today marker, status-coloured task bars and milestone diamonds. Task bar starts and spans are estimated for layout because tasks do not yet store start dates, durations or dependencies, so it is not a true dependency schedule.
Workflow is a delivery flow chart with live counts at each stage that link straight into the board. It answers where work is piling up.
Both are read from the same tasks and milestones as every other view, so neither one needs separate upkeep.
What are weekly stakeholder updates?
A weekly update is a written status prepared inside Kharazm. You can edit the draft, then publish a fixed, read-only snapshot with the evidence captured at that point.
Authorized workspace users can reopen historical publications after the live plan changes. Kharazm stores this in-workspace history; it does not send, email or publicly share the update, so the team chooses how any external recipient receives it.
How does program health work?
A program manager records one of four health ratings:
On track At risk Off track Not started
Reports separately count blocked, overdue, unassigned and open RAID items that can inform that judgment.
The current product does not automatically calculate, lock or forecast the rating. Teams should review the underlying work before publishing an update.
Does Kharazm work on a phone or tablet?
Yes. Kharazm runs in a modern web browser and the interface is responsive, so a phone or tablet works well for reading a program, updating a task status, adding a comment or reviewing a published update. There is no separate mobile app to install.
Denser views such as the timeline and the board are more comfortable on a larger screen. The interface is keyboard accessible throughout.
Cost, data and limits
What does Kharazm cost?
Kharazm publishes Free at $0 for up to 10 people, Standard at $7.91 per person per month, and Premium at $14.54 per person per month; there is no Enterprise tier. The application does not yet collect cards, issue automatic invoices, enforce seats, or gate features. Paid activation and final terms are handled directly, and the annual calculator is an estimate rather than a quote.
Can I export or delete my data?
Deletion is an honest gap. There is no self-serve account or organization deletion in the interface yet, so removal is currently performed at the database level on request. Email hello@bakaroart.com from an address on the account and we will handle it.
Inside a workspace you can already delete tasks and programs and archive programs, subject to your role.
Bulk export is likewise not a finished self-serve feature. Ask us and we will work out how to get your data to you. Both of these are tracked as gaps, not presented as features.
Still have a question?
Anything not covered here — a security questionnaire, an accessibility requirement, whether a particular way of running cohorts fits — goes to one address, and a person answers it.
Put a real program in and see
Request a workspace, or read the security model first — both are fair places to start.