kovacSecurity & trust
Your data stays separate from every other customer's.
The database itself enforces tenant isolation on every row, identity is verified through single sign-on, every change is recorded, and code runs in a sandbox.
- Tenant isolationRow-level security in the database enforces tenant isolation on every table, so an application bug can't expose one customer's data to another.
- SSO & rolesSingle sign-on (OIDC) through kovac's own sign-in service, with role-based access and department-scoped grants.
- Audit log & SIEM exportEvery change is recorded in an append-only audit log you can export to your own SIEM.
- Document-level permissionsA user only sees answers drawn from documents they're allowed to read; permissions come from your connected sources.
- Sandboxed code executionA skill's script runs in an isolated, gVisor-sandboxed container, never inside the API process.
- GuardrailsJailbreak and content checks run on both the question and the answer.
- Encrypted model credentialsAPI keys for model providers are stored encrypted, never in plain text.
- No third-party trackersFonts are served from our own domain and the site loads no third-party analytics or tracking scripts.