Security & privacy
Your people’s data, handled with care.
Kyvora holds salaries, attendance, documents and conversations. Here is exactly how that is kept separate, backed up and seen only by the people who should.
Separation
Your company, kept to itself.
Kyvora is not one big shared database with a company column. Each workspace is set up on its own.
Its own database
Every company gets a separate database. A query in one workspace has nothing of another company’s to find.
Its own file store
Uploads live in a private folder per company. Files are never public; each download is a short-lived signed link.
Its own address
Your team signs in at your workspace’s own address — or at a domain you already own, on the Enterprise plan.
Access
Only the right people see it.
Permissions are set by role and by department, so access follows how your company is actually organised.
Department-level permissions
A manager can see their own department without seeing another’s. Salaries and payroll stay with HR unless you grant more.
Two-factor sign-in
Anyone can switch on an authenticator-app code. Sensitive personal screens ask for it again after a few hours.
Sign-in only from your office
Optionally restrict staff to the IP addresses you list, and block phones and tablets. Both are off until you turn them on.
Guessing is slowed down
Repeated wrong passwords lock the account for a while, and passwords are stored only as one-way hashes.
Resilience
Backed up, and tested.
A backup you have never restored is a hope, not a backup.
Nightly copies
Every company’s database is copied each night and sent to storage in a different location from the servers.
Restores are rehearsed
Each week a backup is restored into a scratch database and checked, automatically.
Watched around the clock
Every workspace is health-checked automatically through the day, and a failure alerts our team.
Monitoring & consent
Insight without surveillance.
Employee monitoring is a powerful tool, so Kyvora ships it switched off and keeps it honest when it is on.
Off by default
Nothing is captured until your company chooses to turn monitoring on.
Consent first
In the browser, screen capture starts only after a consent screen at clock-in, and stops at clock-out.
Counts, not contents
The desktop app counts keystrokes and clicks to measure activity. It never records what anyone types.
Private apps stay private
Password managers and banking apps are never captured. Everyone can see their own activity data.
Recordings
Meeting notes that stay home.
Call recordings are turned into transcripts and written notes by models running on our own servers.
No outside AI service
Recordings, transcripts and notes are not sent to any third-party AI provider to be processed.
Same access as the recording
Only people allowed to watch a recording can read its transcript or notes.
A security question we haven’t answered?
Ask us directly — we would rather explain than have you guess.