This page is maintained by Kyrovo to answer common security and privacy questions about the Kyrovo service. It describes the controls we actively operate today. It is not an audit or certification.
Available in 8 languages via the language switcher (top-right). The English version is authoritative.
SOC 2 Type 1 readiness: Kyrovo is preparing for a SOC 2 Type 1 examination against the AICPA Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy). The controls below describe our current operating practice. We are not currently SOC 2 certified. When the examination completes we will link the auditor's report here.
Security
• TLS 1.3 in transit; AES-256 encryption at rest via managed Postgres
• Row-Level Security enforced on every user-data table (scoped to auth.uid())
• Secrets stored in the managed secret store; never in source, never in logs
• Cloudflare WAF + rate limiting on the public edge
• 2FA required on all Kyrovo staff accounts that can access production
Availability
• Multi-AZ managed Postgres with automatic failover
• GDPR-compliant notification: personal-data breach reported to the relevant DPA within 72 hours
• Users notified without undue delay when a breach is likely to affect their rights
Vendor security
Every sub-processor Kyrovo relies on is reviewed for SOC 2 / ISO 27001 posture before onboarding and re-reviewed annually. The full list lives at /subprocessors and any change is announced at least 30 days in advance.
Responsible disclosure
If you believe you have found a security vulnerability in Kyrovo, please report it privately to security@getkyrovo.com. We commit to acknowledge your report within 2 business days and to work with you on coordinated disclosure. We do not initiate legal action against good-faith researchers who follow this policy.