Security
Plainly stated, so you can check it
Your clients trust you with their data, so you need to know where it sits and who can reach it. What Kervol does today, and what it does not do yet.
In place
8| A database per agency | Each agency's records live in a database of their own. A control plane holds only which agency answers on which address. |
| Sessions bound to the workspace | A sign-in is issued for one workspace's address and refused on every other, including the platform admin. |
| Encrypted channel tokens | Social account tokens are encrypted with AES-256-GCM, under a key used for nothing else, and kept out of history. |
| Roles | Owners, consultants, contributors and read-only staff. A consultant sees only the clients assigned to them. |
| History | Changes to records are kept with who made them and when. |
| PIN-protected client documents | Proposals and Discoveries open with a PIN, and rotating it ends every session opened with the old one. |
| Encrypted in transit | Every connection is TLS, with HSTS. |
| Hosted in Singapore | The application and databases run on Railway, in its Singapore region. |
Not yet
3| No independent certificationKervol has no SOC 2 or ISO 27001 report. This page will say so when that changes. |
| Backup and restoreDatabase backups are on. The restore plan is written and being tested; we will publish what it guarantees once it has been tested end to end. |
| Single sign-onStaff sign in with an email and password, or Google. SAML is not offered. |
Reporting a problem
If you think you have found a security issue in Kervol, email [email protected]. Please give us reasonable time to fix it before you tell anyone else. We reply within two working days.
Founding agencies, by invitation
Per seat, set with each agency. We reply within a working day.