Security & Compliance
We build kvit as a regulator-ready platform from day one. Our security and compliance architecture is designed to satisfy GDPR, the EU AI Act, and SOC2 — the roadmap below shows which building blocks are live today and which ship with backend v1.
EU data residency
All customer data is stored and processed in EU data centres. No transfer to third countries. Neon Postgres + Upstash Redis + Cloudflare R2, each EU-region-pinned.
Immutable audit log
We are building a SHA-256 hash-chained, append-only audit log. The schema is in place (AuditLog.prevHash, AuditLog.hash); the recorder ships with backend v1, designed to satisfy the EU AI Act Article 12 logging requirement.
Encryption at rest and in transit
TLS 1.3 for all network communication. AES-256 for OAuth tokens at rest. Keys managed via a Vault-compatible KMS. We don't roll our own crypto.
Compliance roadmap
- DSGVO — designed for compliance from day 1; AVV/DPA and DPIA templates under counsel review, right-to-erasure workflow ships with backend v1.
- EU AI Act — we score invoices, not persons. Human-override interface ships with backend v1.
- SOC2 Typ I — targeted Q3 2026.
- SOC2 Typ II — targeted Q1 2027.
- ISO 27001 — targeted as a prerequisite for enterprise contracts in 2027.
Report a security issue
If you find a security issue, please disclose it confidentially to security@kvit.ai. We respond within 24 hours and remediate critical issues within 72 hours.