You own everything we build
Code, prompts, evaluation datasets, infrastructure definitions, documentation — all of it is yours at handover. No license-back, no proprietary runtime you have to keep paying for.
Trust
Practices, not badge walls.
What actually happens to your systems and data when we work together — written the way we'd want a vendor to write it for us. This page is about consulting engagements in your cloud; how khavion.com itself (the site, accounts, and the reviewer) is secured lives on /security.
01 / The two promises
We sign BAAs
For engagements touching protected health information, we sign a Business Associate Agreement and configure Security Rule safeguards: encryption, IAM/MFA, audit logging, six-year log retention.
02 / Security practices
- Data boundaries
- Your data stays in your cloud accounts. We work inside your boundary, not on copies in ours.
- Encryption
- In transit and at rest, on every system we design — TLS everywhere, KMS-managed keys.
- Access control
- Least-privilege IAM with MFA. Engagement access is revoked at handover, and we ask you to verify it.
- Audit logging
- CloudTrail (or the Azure equivalent) configured on delivered systems; six-year retention where HIPAA applies.
- Regulated work
- We build HIPAA-eligible architectures and sign Business Associate Agreements. There is no HHS-recognized certification for HIPAA, so we describe safeguards precisely instead of borrowing a stamp that doesn’t exist.
- Secrets
- No credentials in code or chat, ever. Secret managers on both sides, rotated at engagement end.
No badge wall here: we publish practices, not logos we haven’t earned. Certifications will appear when they exist.
Questions about how we'd handle your data?
Bring them to a 30-minute fit call — concrete answers about your systems, your boundaries, and whether we're the right fit.