FAQ
Frequently asked questions
Sixteen straight answers about what Kharazm does, how access and permissions work, what protects a workspace, and what has not been built yet. If your question is missing, write to us and we will answer it — and probably add it here.
The basics
What is Kharazm?
Kharazm is a program-management workspace for organizations that receive and pass through grant funding. A workspace holds programs with owners, dates, objectives, tasks, milestones, risks, issues and decisions, and each program can carry an award record with subrecipients, written risk assessments, dated monitoring and links to evidence.
The same data powers board, list, timeline and workflow views, reports, manager-recorded program health, weekly updates that are published as read-only records, and a printable audit pack for each award. It is a hosted web application, not something you install.
Who is Kharazm for?
Kharazm is for teams accountable for multi-step programs and regular stakeholder reporting.
That can include cross-functional delivery teams, government and nonprofit programs, grant-funded initiatives, operational change, community programs, and learning and development. It is most useful when a team needs shared ownership, visible risk and a defensible record of status without a configuration-heavy portfolio suite.
What is the difference between a program, a task and a milestone?
A program is the whole effort — for example a launch, rollout or learning program — with an owner, start and end dates, an objective, progress and a health rating. Programs can be created, edited, archived and deleted, and grouped into portfolios.
A task is a piece of work inside a program. It carries a status, priority, assignee, due date, labels, a blocked flag and chronological comments.
A milestone is a dated checkpoint that marks progress rather than holding work of its own, and it appears as a diamond on the timeline.
To do In progress Review Done
Access, roles and your team
How do I get access, and why does a new workspace need approval?
A signed-out person confirms their email address, and their initial registration then creates a pending workspace request that an operator reviews. Once approved, the requester can sign in. A colleague's invitation to an existing workspace bypasses that queue.
An already signed-in user can also create an additional workspace immediately. Initial review reduces automated signups, but it is not identity verification or approval of every tenant.
What are the four access levels and what can each one do?
Admin, manager, member and viewer, in that order of privilege.
| Role | What it can do |
|---|---|
| Admin | Create and delete programs, manage the people in the organization, read and download the audit log, and export or delete the workspace — plus everything below. |
| Manager | Create and delete tasks, manage programs and milestones, record awards and subrecipients, and publish updates — plus everything below. |
| Member | Edit tasks, change status and comment; log risks and decisions; log subrecipient monitoring, close findings and add evidence links. |
| Viewer | Read-only. A viewer invitation can be limited to chosen awards with an access end date, which suits an auditor or a funder. Viewers are free on every plan. |
Every one of these checks runs on the server, using the identity from your session rather than anything the browser sends. Hiding a button is never the only thing standing between a role and an action.
Can I invite my team, and how do invitations work?
Yes. An admin creates an invitation for a specific email address and assigns the role at the same time. The token is stored only as a SHA-256 hash, expires after seven days, can be revoked, and can be accepted once by that email address.
If transactional email through Resend is configured, the link is emailed; otherwise the admin can share the generated link securely. A new or existing account can accept it without entering the initial-registration approval queue; someone who already has an account signs in and confirms before joining. A viewer invitation can be limited to chosen awards and given an access end date. Roles can be changed later, and membership changes create organization audit entries.
What happens if I forget my password?
When transactional email is configured, use the reset flow from the sign-in screen. Kharazm emails a single-use link valid for one hour; only a SHA-256 hash of the token is stored.
Setting a new password revokes every existing session. The forgot-password endpoint returns an identical response whether or not an account exists. Without configured email delivery, a reset message cannot be delivered and the operator must restore access through a separate support process.
Security and privacy
Is my organization's data isolated from other organizations?
Yes. The organization is the intended security boundary in Kharazm. Server queries and writes are scoped to the organization on the authenticated session, and automated tests cover cross-tenant isolation.
Every change creates a per-organization audit entry recording who made it, when, and what changed, with before and after values. Entries are append-only and visible only to admins.
What security protections are in place?
The short version:
- Passwords hashed with scrypt and a per-user random salt, verified in constant time
- Optional two-step sign-in with an authenticator app and ten single-use recovery codes; the authenticator secret is encrypted at rest
- Email addresses confirmed, and each person can see their own sign-in activity
- Sessions as 32-byte opaque tokens; only the SHA-256 hash is stored
- httpOnly, SameSite=Lax session cookie that is Secure in production and expires after 14 days
- Permissions enforced server-side, with the actor taken from the session
- HTTPS enforced with HSTS, plus a strict Content-Security-Policy, X-Frame-Options DENY, nosniff, a same-origin referrer policy and camera, microphone and geolocation switched off
- CSRF defence from SameSite cookies plus a same-origin guard on state-changing requests
- Bounded, instance-local rate limiting on authentication and high-impact authenticated write routes
- Strict discriminated Zod schemas for all 39 supported domain writes, including operation-specific IDs, enums, dates, text lengths and arrays; unknown keys are rejected
Known gaps are published rather than hidden: no way for an organization to require two-step sign-in, no single sign-on, backup guarantees that depend on the database plan, instance-local rather than distributed rate limiting, and no third-party penetration test.
Does Kharazm use trackers, analytics or third-party integrations?
No third-party analytics, trackers or advertising technology run in the browser. The web font is self-hosted, and the Content-Security-Policy restricts browser connections to the application's own origin.
There are no product integrations or AI/agentic features today. Kharazm does not connect to Slack, Microsoft Teams, Workday, an LMS, a model provider or other work systems. AI and agentic assistance is a roadmap workstream, not a current feature.
The server uses Fly.io and Neon, plus Resend when transactional email is configured and Stripe for billing. Without email, invitation links can be shared manually, but password-reset and approval messages cannot be delivered.
Data stored is minimal by design — your account email, display name, organization membership and role, the program data your team creates, a billing record for each workspace, and your own sign-in activity. Card and bank details are entered on Stripe's pages and never reach Kharazm's servers.
Using Kharazm day to day
What do the Timeline and Workflow views show?
Timeline is a Gantt-style due-date visualization with month gridlines, a today marker, status-coloured task bars and milestone diamonds. Task bar starts and spans are estimated for layout because tasks do not yet store start dates, durations or dependencies, so it is not a true dependency schedule.
Workflow is a delivery flow chart with live counts at each stage that link straight into the board. It answers where work is piling up.
Both are read from the same tasks and milestones as every other view, so neither one needs separate upkeep.
What are weekly stakeholder updates?
A weekly update is a written status prepared inside Kharazm. You can edit the draft, then publish a fixed, read-only snapshot with the evidence captured at that point.
Authorized workspace users can reopen historical publications after the live plan changes. Kharazm stores this in-workspace history; it does not send, email or publicly share the update, so the team chooses how any external recipient receives it.
How does program health work?
A program manager records one of four health ratings:
On track At risk Off track Not started
Reports separately count blocked, overdue, unassigned and open RAID items that can inform that judgment.
The current product does not automatically calculate, lock or forecast the rating. Teams should review the underlying work before publishing an update.
Does Kharazm work on a phone or tablet?
Yes. Kharazm runs in a modern web browser and the interface is responsive, so a phone or tablet works well for reading a program, updating a task status, adding a comment or reviewing a published update. There is no separate mobile app to install.
Denser views such as the timeline and the board are more comfortable on a larger screen. The interface is keyboard accessible throughout.
Cost, data and limits
What does Kharazm cost?
Kharazm is priced per organization by active award count, Recipient is $60 a month or $600 a year, Pass-Through $180 or $1,800, and Portfolio $360 or $3,600 — annual prepay costs ten months rather than twelve, and carries the same features and limits as monthly. Every workspace starts with a 14-day free trial of the full product, with no card required; the trial is per person, so a second workspace shares the first one's trial. There is no perpetual free tier, because a one-award free plan would simply be worked around by opening one workspace per award. External viewers such as funders, auditors and subrecipients are free on every paid plan, and organizations under $2M in revenue take 25% off, self-declared when you choose a plan. Three days before the trial ends, we email the workspace's admins a link to Plan & billing, where an admin chooses a plan and pays on Stripe-hosted Checkout by card or US bank account (ACH); an admin can also do this at any time. Subscriptions renew automatically, monthly or annually, until cancelled in the Stripe customer portal, and prices exclude any applicable taxes. If you need an invoice to pay by check or bank transfer instead, contact us. When a trial ends without a plan, or a paid plan ends, the workspace stays readable and exportable, but adding or changing records needs an active plan; nothing is deleted.
Can I export or delete my data?
Yes, yourself, in the app. An admin can export the whole workspace as JSON — every record, the members, the invitation history, the audit log and a billing summary — and anyone can download the personal data Kharazm holds about them. Each award's audit pack can also be generated as a printable document and a CSV.
Anyone can delete their own account: their sign-in, memberships and sessions are removed and their name becomes “Deleted account”, while records they created stay in the workspace, which belongs to the organization. An admin can permanently delete the whole workspace by entering their password and typing its name.
While the workspace exists, some records are protected: published updates and monitoring history cannot be deleted, and awards or subrecipients with records on file cannot be deleted one by one.
Still have a question?
Anything not covered here — a security questionnaire, an accessibility requirement, whether a particular way of running cohorts fits — goes to one address, and a person answers it.
Put a real program in and see
Request a workspace, or read the security model first — both are fair places to start.