diff --git a/core/kg/model/config.go b/core/kg/model/config.go
index fd8c034..cc556ff 100644
--- a/core/kg/model/config.go
+++ b/core/kg/model/config.go
@@ -17,6 +17,7 @@
 	SQL  SQLConfig
 	HTTP HTTPConfig
 	GRPC GRPCConfig
+	App  AppConfig
 }
 
 func NewConfig() *Config {
@@ -80,3 +81,15 @@
 		s.Port = defaultGRPCPort
 	}
 }
+
+type AppConfig struct {
+	EnableSignUp *bool
+}
+
+func (s *AppConfig) SetDefaults() {
+	if s.EnableSignUp == nil {
+		s.EnableSignUp = NewBool(true)
+	}
+}
+
+func NewBool(b bool) *bool { return &b }
diff --git a/core/kg/model/user.go b/core/kg/model/user.go
index 156f4fa..5bcb8a0 100644
--- a/core/kg/model/user.go
+++ b/core/kg/model/user.go
@@ -5,6 +5,7 @@
 	"unicode"
 
 	"github.com/pkg/errors"
+	"golang.org/x/crypto/bcrypt"
 )
 
 const (
@@ -46,11 +47,40 @@
 	return nil
 }
 
+// Clone clones the object
 func (u *User) Clone() *User {
 	user := *u
 	return &user
 }
 
+// SanitizeInput removes input data from the user object that is not user controlled
+func (u *User) SanitizeInput() {
+	u.ID = ""
+	u.CreateAt = 0
+	u.UpdateAt = 0
+	u.DeleteAt = 0
+	u.LastPasswordUpdate = 0
+}
+
+// SanitizeOutput removes output data from the user object that is not user controlled
+func (u *User) SanitizeOutput() {
+	u.Password = ""
+}
+
+// HashPassword hashes user's password
+func (u *User) HashPassword() {
+	if u.Password == "" {
+		return
+	}
+
+	hash, err := bcrypt.GenerateFromPassword([]byte(u.Password), 10)
+	if err != nil {
+		panic(err)
+	}
+
+	u.Password = string(hash)
+}
+
 func isValidID(value string) bool {
 	if len(value) != 26 {
 		return false