Our security program is designed to meet the requirements of the most security-conscious enterprises in the world.
Annual audit by an independent CPA firm. Report available under NDA for enterprise customers. Covers Security, Availability, and Confidentiality.
Request Report →Certified Information Security Management System covering our entire platform, development processes, and customer data handling.
Annual third-party penetration test by a CREST-accredited firm. Findings summary available to customers on request.
By default, Kovral stores only metadata about each request — risk score, threat classification, timestamp, user ID, and policy outcome. Prompt and response content is analyzed in memory and discarded. Full content logging is opt-in and configurable per policy with your own encryption keys.
AES-256 encryption at rest. TLS 1.3 in transit. Customer-managed encryption keys (BYOK) available on Enterprise plans. No Kovral employee can read your prompt content without cryptographic access you control.
SaaS plan: data processed and stored in US-East. Enterprise plans: choose US, EU, or deploy in your own cloud account for complete data sovereignty. Regional isolation includes compute, storage, and logging infrastructure.
We do not use customer prompt data to train, fine-tune, or improve our AI models. This is contractually guaranteed in our DPA. Our threat detection models are trained on synthetic and publicly available adversarial examples only.
Our security team responds to enterprise inquiries within one business day.
