Security you can trust

What is actually in place, stated plainly — including what is not. Ordinary conversations are attested and auditable rather than end-to-end encrypted; private conversations are end-to-end encrypted. This page explains what each buys and what it costs.

Your customers' messages, treated properly

Encrypted in transit and at rest, isolated from every other account, and yours to export or delete whenever you want. Ordinary conversations are auditable rather than end-to-end encrypted — we would rather tell you that plainly than let you assume otherwise — and a private conversation is end-to-end encrypted when you…

Encrypted in transit and at rest

Messages are encrypted on the way to us and encrypted where they sit. Your account's data is isolated from every other account on Kanvo.

Your data is yours to export

Your contacts, your threads and the whole history behind them belong to you. Take them out whenever you want them.

Delete your account, and it's gone

Deleting means deleted. Not deactivated, not hidden from you while we keep a copy, not held back in case you change your mind.

GDPR aware

We keep track of what we hold, why we hold it, and what you can ask us to do with it. We say aware rather than certified on purpose.

Built secure from day one

Every layer of Kanvo is designed with security as the foundation, not an afterthought.

Signed Message Provenance

Every delivered message is signed with a per-tenant Ed25519 key and appended to a hash-chained ledger. Private keys are stored wrapped under a master key held only in function environment — never in the database, and unreadable even to the account that owns them.

Append-Only Evidence

Attestations cannot be updated or deleted by anyone, including the account that created them. Ledger roots are published to Sigstore's Rekor transparency log and timestamped into Bitcoin, so tampering is detectable by someone who does not trust Kanvo.

Encrypted in Transit and at Rest

Traffic is protected with TLS and stored data is encrypted at rest. Ordinary conversations are not end-to-end encrypted — messages are readable by the platform so they can be searched, summarised and produced as records. Calls are the same: media is encrypted to the server (DTLS-SRTP) and decrypted there, which is wha…

Private Conversations

A direct conversation or a group can be started private. Private conversations are end-to-end encrypted with MLS (RFC 9420): each device holds its own keys, the server stores only ciphertext, and safety numbers let two people check nobody added a device. Kanvo still sees who is in the conversation and when messages ar…

Row-Level Access Control

Every table enforces row-level security, so one account can never read another’s data. Access is scoped per user and every API key is hashed at rest.

Data Minimisation

Message content is kept out of server logs, and the build fails if it appears. Public verification stores a salted hash of who asked, never who asked. Push previews can be switched off so message text never reaches Apple or Google.

Advanced Authentication

Multi-factor authentication with passkeys and recovery codes, sign-in with Google, Apple or a wallet, a registry of every signed-in device, and step-up prompts on the actions that outlive a session.

Secure Infrastructure

Hosted on managed infrastructure with encryption at rest, network isolation and provider-level DDoS protection.

Audit Logging

Comprehensive audit trails for all administrative actions, and security alerts when a new device signs in.

Security practices we follow

We're committed to maintaining the highest security standards for your data.