How Kav keeps your data secure
How Kav keeps customer data secure: database-level separation between customers, encrypted secrets, audited staff access and encrypted backups.
Short answer
Kav keeps each customer's data separate at the database level, stores secrets encrypted, records every staff view of personal data, and keeps encrypted backups. Here is how the platform is built and what we check ourselves.
What we did test
We ran an internal security pass against the platform itself, covering tenant isolation, token validation, privilege escalation, query-cost limits and injection. It is documented, and it also recorded real defects that were then tracked.
How customers are kept apart
Every customer's data carries a tenant identifier. The application filters by it, and the database enforces it with row-level security, so isolation does not depend on application code alone.
Identity is never taken from the caller
Who a customer is comes from their verified session on the server. The assistant cannot be told, or talked into using, a different person's identity.
Secrets
Credentials are stored encrypted per customer. The admin console shows a fingerprint and a last-used time, never the value, at any privilege level.
Staff access and logging
Staff permissions are per operation. Staff viewing personal data is recorded with who and why. Logs and traces pass through a scrubber that removes identifiers, tokens and similar values, and it is on by default.
Backups and the host
Backups are encrypted and a restore is tested on a schedule. The production server's disk is encrypted.
Want detail?
Ask for the security notes in a live demo, or tell us what your security review requires.