SECURITY
Security Specs
How Kovallent handles access, encryption, and your code — in plain terms.
Security architecture & governance
KOVALLENT ZERO-TRUST ARCHITECTURE
Customer
Repositories
Repositories
──────►Read-Only OAuth
TLS 1.3
TLS 1.3
Ephemeral
Sandbox
Sandbox
──────►AST Metadata
Only
Only
Zero-Knowledge
KMS
KMS
Production
Databases
Databases
────✗────No Access
Air-Gapped
Air-Gapped
Ephemeral
Sandbox
Sandbox
Core security controls
1. Strictly non-destructive & read-only access
- Read-Only Scopes: Kovallent connects to GitHub Enterprise or GitLab via strictly read-only OAuth apps or personal access tokens.
- Zero Write Permissions: Kovallent cannot modify code, merge pull requests, or alter repository settings without explicit execution through local kv-cli developer actions.
2. Encryption standards
- Data in Transit: All network communication is enforced via TLS 1.3 with HTTP Strict Transport Security (HSTS).
- Data at Rest: All account data and encrypted contract schemas are secured using AES-256 with AWS KMS envelope encryption and per-tenant isolation keys.
3. Compliance attestations & audits
- SOC 2 Type II: Certified under SOC 2 Type II Trust Services Criteria for Security, Availability, and Confidentiality.
- Vulnerability Management: Continuous automated dependency scanning, monthly container vulnerability assessments, and annual third-party penetration testing (PenTest reports available under NDA).
- Responsible Disclosure: Security vulnerability reports can be submitted directly to security@kovallent.com.