KiviDB Trust Center

This site states what KiviDB does to protect customer data, what it does not do yet, and where the supporting documents are. It covers KiviDB Cloud, the managed service at kividb.io.

Everything here is a statement by KiviDB about its own systems. KiviDB has not been audited by an independent third party and holds no security certification. Where a control is missing or partial, this site says so.

Summary

Area	Status	In short
Encryption in transit, website and API	In place	TLS 1.2 or higher only.
Encryption in transit, to your database	Partial	TLS is available and can be required. It is off unless you turn it on.
Encryption at rest	Partial	Database disks and backups are encrypted with provider-managed keys. Customer-managed keys are not offered.
Network controls	Partial	A firewall per database, closed by default, and private connectivity. On Azure and Google Cloud customers' servers share a virtual network and are separated by per-database firewall rules.
Sign-in	Partial	Hashed passwords, Google sign-in, single sign-on, attempt limits, and two-factor authentication by authenticator app. Two-factor is off unless you turn it on or your organization requires it.
Access by KiviDB staff	Partial	No shell access to database servers and no "log in as customer" function. KiviDB does hold the credentials needed to operate each database.
Backups	Partial	Snapshots on demand, scheduled snapshots you can switch on, and an append-only log on paid plans. Scheduled snapshots are off by default.
Payments	In place	Card details are handled by Razorpay and never reach KiviDB.
Tracking	In place	No analytics, advertising or tracking cookies.
Independent audit or certification	Not in place	No SOC 2, ISO 27001 or penetration test.

Details are on the Security and Data pages.

Not in place yet

These are the gaps a security review should know about. They are listed here so that nobody has to discover them.

No independent audit, certification or penetration test.
Two-factor authentication is off unless you turn it on or your organization requires it, and it is by authenticator app only: no hardware security keys or passkeys. API keys are not asked for a second factor.
Scheduled backups are off unless you switch them on for a database, and there is no recovery to an arbitrary point in time.
TLS to your database is optional and off by default. Replication between the nodes of one database is encrypted only when you turn on encrypted replication (it needs TLS, and is off by default). Management connections from KiviDB to the database are not encrypted in transit.
On AWS, disks created before 11 October 2026 are not encrypted at rest. Disks created since then are.
No customer-managed encryption keys.
The KiviDB server download is not signed. Updates to the management agent on each server are.
No content security policy on the website.
Test and production systems share cloud accounts.
Free-tier databases run on shared servers and do not have the protections described for paid plans.

Documents

Security: the controls, area by area.
Data: where data is kept, for how long, and what deletion does.
Sub-processors: the companies that process personal data for KiviDB.
Compliance: which frameworks apply and which do not.
Vulnerability disclosure: how to report a security problem.
Data Processing Agreement.
Privacy Policy, Terms of Service, Service Level Agreement and the KiviDB License (AGPLv3), on kividb.io.

Change log

Date	Change
23 October 2026	An audit log for each organization: sign-ins, membership and role changes, API keys, database, network and credential changes, exports and billing, by person or API key, with the address they came from. Owners and admins can read and export it; events are kept for a year.
20 October 2026	A public status page at status.kividb.io, run by Better Stack, an independent monitoring service: it checks the website, API and MCP server directly, and each service's own health check (provisioning, databases, search, vector search, snapshots, schedules, metrics, logs) once a minute, and keeps the record itself.
20 October 2026	A read-only Viewer role, for people and API keys: it sees an organization's databases, metrics, logs and settings, and is refused every change and every password, key, document and snapshot download.
11 October 2026	Two-factor authentication is available on KiviDB accounts, and an organization's owner can require it of every member.
10 October 2026	Scheduled disk snapshots, which could be switched on in the console but were not being taken, are now taken. They remain off by default.
10 October 2026	Database passwords are now encrypted by the application before they are stored. On Azure and Google Cloud, a database's nodes now accept traffic from inside the shared network only from each other.
10 October 2026	First publication.

Contact

Security reports: security@kividb.io. Privacy and data protection: privacy@kividb.io. Questions for a security review that this site does not answer: either address.