Security

Keva has selected source-level security controls, but formal SOC 2 readiness, certification, and auditor proof remain unproven. This page separates those controls from configured, deployed, and live product evidence.

Current source-backed controls

Access control

Keva defines role-based access control with 38 permissions. A permission entry or route-level source check is not proof that every deployed path is configured and enforced; use the Roles and Audit Log screens for the product evidence available to your workspace.

Audit logging

The top-level Audit Log at /audit-log exposes selected recorded events from mapped workflows. Coverage is not universal, so the log is supporting evidence for security investigation rather than a complete record of workspace activity.

Selected credential encryption

Selected application paths use AES-256-GCM credential envelopes with a fresh IV and authentication tag. Ordinary ticket, message, customer, and analytics fields are outside that application-level encryption claim. Previous-key fallback exists, while the global credential re-encryption function is suspended.

Configured storage, provider, backup, deployment, and runtime behavior require independent verification. Successful local encryption is not proof of whole-application encryption or deployed storage protection.

Authentication and infrastructure boundary

Clerk integration exists in source, but configured MFA and session behavior require product verification. The active hosting provider, topology, region, provider-level database encryption, and backup configuration are not established by this page.

Security features

Availability and retention limits

Team alerts

Team alerts are not available in the current Channels UI. Keva does not send alerts to Slack or Teams yet. Check Approvals and Tickets in Keva for work that needs attention. A source-level alert path is not a promise of configured recipient, deployment, or delivery.

Deletion and retention

This page does not promise that all tenant data is removed on account deletion, that audit logs are retained for a stated period, or that backups are rotated on a fixed schedule. Deletion scope, retention, backup storage, and restoration remain unverified without configured/provider read-back; retention remains unverified.

Monitoring and response

The Audit Log is not real-time monitoring and does not establish anomaly detection, automatic alert delivery, a fixed review target, or customer notification. Any incident response or alerting workflow needs separate configured and live evidence.

Compliance boundary

Keva is preparing for formal SOC 2 review and is not currently claiming SOC 2 readiness, certification, or an auditor opinion. See Compliance for the evidence boundary.