Security and data handling

Data boundaries

Your data stays in your cloud accounts. We work inside your environment and do not copy your data into Khavion's.

Encryption

Every system is designed with encryption in transit and at rest: TLS, and keys managed in your KMS.

Access

We ask for the least access the job needs, with MFA. At handover you remove the access, and we ask you to confirm it is gone.

Audit logging

We set up CloudTrail, or your cloud's equivalent, on what we build. Where HIPAA applies, log retention is set to six years.

Secrets

No credentials in code or chat messages. We use a secret manager, ask you to do the same, and rotate anything we held when the job ends.

Healthcare data

If a job touches protected health information, the Business Associate Agreement is reviewed with you before work starts, and the decision is made case by case. Khavion's founder built in a HIPAA-eligible environment before, at a previous employer.

Code, prompts, evaluation data, infrastructure definitions, and documentation are yours at handover. There is no license-back and no runtime you have to keep paying Khavion for.

• Messages from the contact form: your name, email, and message. Stored in Khavion's database and CRM so you get a reply.
• The AWS application check and the AI check run in your browser. Your answers reach Khavion's server only if you ask for the result by email. Then your name, work email, answers, and result are stored.
• The Microsoft score check runs in your browser and has no email step, so its answers never reach Khavion's server.
• The Competency evidence check runs in your browser. Case study text you paste never leaves it. Asking for the full memo sends your answers to the program and tier questions and the control results, with your work email, and Khavion stores those.
• The partner calendar needs no email to read. Subscribing to change notices stores your work email and the programs you ticked; each notice has an unsubscribe link.
• The Architecture Review runs in your browser, and your diagram, Terraform, and description never leave it. The email step sends only the ids and severities of the findings, your mode and production answers, and your work email. Khavion stores those, the estimate total, and a timestamp, and the link in your email reopens the report for 7 days. A shareable link, if you make one, needs no email, carries only the score and counts of findings, shows no findings, and works for 30 days. No account, no password.
• Booking details go to Zoho Bookings when you book a call.
• Counts of page views, form submissions, and how many checks and reviews were started and finished and with which result. No cookies, and nothing that identifies you.
• A theme setting in your browser, so the site remembers light or dark.

Who processes it: Vercel (hosting and page view counts), Neon (database), Resend (email), Zoho (CRM, bookings, and Khavion's business email), GitHub (code and encrypted database backups).

To see, correct, or delete what Khavion holds about you, email hello@khavion.com. Replies within 30 days.

• No SOC 2 report, and no plan for one yet.
• No third party has been paid to test this website's security.
• Khavion is a member of the Microsoft AI Cloud Partner Program and does not hold a Solutions Partner designation or specialization.

Khavion answers security questionnaires (CAIQ, SIG, or your own). Email hello@khavion.com.