Security at Keyavi

Keyavi protects the file itself. That same idea shapes how we protect our own platform and your account.

Your content stays yours

When you protect a file with SafeSuite™, its encryption and access policies are part of the file. Keyavi does not capture, access or store the content of the files you protect. Our systems handle only the metadata needed to enforce your policies, such as who may open a file, until when, and from where.

Control even after sharing

Owners can change policies or revoke access at any time, even after a file has been shared. Every attempt to open a protected file is checked against its policy and logged. Unauthorized attempts are denied, and the owner's administrator is notified.

Where the platform runs

SafeSuite runs on Microsoft Azure in the United States (West US 2 region). Traffic reaches it through Azure Front Door. Microsoft's data centers hold independent certifications such as SOC 2 and ISO 27001.

Encryption

• In transit: traffic uses TLS, and our databases accept TLS 1.2 or newer only.
• At rest: data is encrypted at rest in Azure.
• Keys: encryption keys and application secrets are kept in Azure Key Vault.

Signing in

Signing in to the SafeSuite portal requires multi-factor authentication, with SMS verification.

Access inside Keyavi

• Employees sign in through Microsoft Entra ID with multi-factor authentication.
• Access to production follows least privilege and is reviewed regularly.
• Database access is limited to approved network addresses.
• When someone leaves, their access is removed as part of a documented offboarding process.

Secure development

We follow a Secure Software Development Lifecycle:

• source code is scanned for vulnerabilities (SAST)
• third-party and open-source dependencies are checked for known exposures (SCA)
• the running application and APIs are tested the way an attacker would approach them (DAST)
• every release goes through our automated build and deployment pipelines, from development through QA and release-candidate environments to production

Findings are prioritized by risk and fixed before release.

Monitoring and response

• Production systems are monitored and their activity is logged.
• We keep a documented incident response plan.
• If an incident affects your data, we will notify you without undue delay and as the law requires.

Compliance

Keyavi is working toward a SOC 2 Type II report.

Our Trust Center, where you'll be able to review the security controls we have in place, is coming soon. In the meantime, to request our security documentation, email security@keyavi.com.

Report a security issue

If you think you've found a vulnerability in a Keyavi product or website, email security@keyavi.com with enough detail for us to reproduce it. Please give us a reasonable time to fix the issue before you share it publicly, and don't access or change other users' data. We will confirm we received your report within 3 business days.