Kovan
Sign up
← Home

Data security

Last updated: 25 October 2026

This page answers the questions a founder should ask before trusting Kovan with company data. Legal rights sit in the Privacy Notice. A control that is not written here is not something Kovan has.

Where data lives

Startup profile, chat, documents, decisions, memory, and work records sit in a Supabase database. The production region is Mumbai (ap-south-1). The app runs on Vercel in Frankfurt (fra1).

Passwords are held by Supabase Auth. Kovan does not store a plaintext password.

Images sit in Supabase file storage. Document text sits in database rows. Kovan does not encrypt those rows with your key.

Integration access tokens (Gmail, GitHub, and the like) are encrypted with AES-256-GCM in the application before they are written in production. That encryption does not cover documents or chat.

Card numbers are not written to Kovan’s database. Payment goes through PayTR or Paddle.

Who can open it

  • The founder sees their own startup.
  • A co-founder sees that same startup.
  • A domain member can open only the assistant they were assigned. They cannot open another domain’s chat.
  • Another customer cannot open your startup. The server binds every request to the signed-in user’s own startup. A document, chat, memory, work record, or file link from another startup is refused. A domain member cannot open another domain on the page or on the server. The public database key is also closed by row rules. The application server uses a separate service key; on that key the startup check in code is the boundary.
  • The person who operates Kovan can read the database with the server key in order to run the service. This is a sole proprietorship. We do not say that nobody can see the data.

How AI providers handle it

Content needed to produce a reply is sent to the OpenAI API. That includes the startup profile, the chat message, a document pulled into context, and what the agent observed on that run.

Since 1 March 2023, OpenAI does not use API inputs and outputs to train models unless you explicitly opt in to share them. Kovan does not turn that sharing on.

OpenAI may keep this content for up to 30 days for abuse monitoring. Kovan does not have a Zero Data Retention agreement. We do not describe one.

Source: OpenAI — Data controls.

When web search is on, the query is sent to Tavily. That query can be derived from startup context.

If you connect an integration, Kovan calls that service for the job you connected. Data is not sent to a service you did not connect.

Deletion

On the billing page the founder confirms with their password and the word SİL (or DELETE). That deletes the user. The startup row is tied to that user, so it is deleted with them. Images for that startup are removed from file storage.

This does not instantly erase OpenAI’s abuse-monitoring log. That log follows their retention. The payment company may keep the transaction record for its own legal duty.

Deleting one library document does not delete the account.

Export

There is no screen that downloads the whole startup as one file. You can download a single library document. For a copy of the account, write to hello@kovan-ai.com. That is not a self-serve export.

Backup

There is no customer screen to download or restore a backup. The database provider’s own operational backup is not your copy.

What is absent

  • No customer-managed encryption key.
  • No OpenAI Zero Data Retention agreement.
  • This page does not claim SOC 2 or ISO certification.
  • No promise of a separate server per customer. Isolation is the startup bound to the session, in the same database.