KavachEncryption
ProtectAES-256 encryption at rest and TLS 1.3 in transit. Customer-managed keys and BYOK available on enterprise plans.
Kavach-AI protects AI agents and the data they touch — so we hold ourselves to the same standard. Here is how we secure the platform and the controls you can verify.
Independent audits and always-current evidence, available under NDA in the trust center.
AES-256 encryption at rest and TLS 1.3 in transit. Customer-managed keys and BYOK available on enterprise plans.
Logical isolation per tenant with per-customer data stores, namespaced keys and strictly scoped service identities.
SAML SSO, SCIM provisioning, role-based access control and mandatory MFA for all Kavach-AI personnel.
Peer-reviewed changes, signed artifacts, dependency scanning and regular third-party penetration tests.
24/7 alerting on anomalous access, centralised immutable audit logs and a documented incident-response plan.
Multi-AZ deployment, encrypted backups, tested restore procedures and a published uptime target.
We never train models on customer data, and we keep deletion and residency explicit.
| Data | Why we process it | How it is protected |
|---|---|---|
| Account & identity data | Authentication, billing, support | Encrypted at rest, RBAC-scoped, retained per policy |
| Tool-call metadata | Detection, inventory, audit | Encrypted, masked secrets, tenant-isolated |
| Prompt & payload content | Policy enforcement in transit | Scanned in memory; not retained by default |
| Telemetry & logs | Reliability and security monitoring | Immutable, access-logged, configurable retention |
| Model training | — | Never uses customer data |
We welcome reports from the security community and we will not pursue legal action against good-faith research conducted under our safe-harbor policy.
SOC 2 Type II report, penetration-test summary, DPA and sub-processor list — under NDA.