Security
Kovee applies safeguards appropriate for a rental-management platform and clearly explains where your data may flow.
The application, database, and operational services are hosted with selected cloud providers. Some services may process data in Canada, the United States, or other regions. Transfers are limited to service needs and governed by our agreements with providers.
Communications with Kovee use HTTPS/TLS. Infrastructure providers apply encryption to their managed storage services. Kovee passwords are hashed with bcrypt and are not stored in plain text.
Two-factor authentication is available to strengthen account protection. Sessions and access tokens are limited and managed server-side. We recommend using a unique password and enabling two-factor authentication.
Access to production environments and data is limited to people and services that need it to operate, support, or secure Kovee. Permissions are restricted according to responsibilities.
You retain your rights to the data you add to Kovee. Export tools are available for several data sets and reports. You may also request access, correction, or deletion in accordance with our privacy policy and applicable legal obligations.
We use our infrastructure providers' backup and resilience mechanisms and maintain continuity and recovery procedures. Their scope may evolve with the service architecture.
Payments are processed by Stripe. Kovee does not store full card numbers on its servers. Stripe maintains its own security controls and certifications for payment processing.
To answer a request, Kovee Agent may send AI providers the context required for that task. We limit that context to the requested work. Always review important answers: Kovee Agent assists your work but does not replace your judgment or legal, tax, or professional advice.
We maintain an incident-management process. If an incident creates a real risk of significant harm, affected people and authorities are notified as required by applicable law.
If you discover a potential vulnerability, email security@kovee.io with reproduction steps and observed impact. We will assess the report and coordinate the appropriate follow-up.
Key service providers
These providers may process data depending on the features you use. The list and regions may evolve with our services.
| Vendor | Purpose | Region |
|---|---|---|
| Railway | API, database, and application services | Canada / United States depending on service |
| Cloudflare | Document storage, network, DNS, and email routing | Global network |
| Vercel | Marketing-site hosting | Global network |
| Stripe | Payments and subscriptions | Canada / United States |
| Resend / SendGrid | Transactional email | United States |
| OpenRouter / Groq | Artificial-intelligence services | United States / model dependent |
| Tavily | Web search used by Kovee Agent | United States |
| SingleKey | Credit and background checks | Canada |
| PostHog | Consent-based usage analytics | Depends on service configuration |
| Expo | Technical services for the mobile application | United States / global network |
| Crisp | Customer support and messaging | European Union / global network |
For a question or responsible vulnerability report, use our dedicated address.
security@kovee.io