Security and your data
If your team works somewhere that makes you careful about what leaves the building, this page is for you. It is the plain-English companion to our Privacy Policy.
Secure servers, managed by us
Every product runs on Amazon Web Services (AWS) in the United States, in AWS’s physically secured, independently audited data centers. We don’t own the hardware; we configure, harden, patch and monitor every server ourselves. Each service is isolated from the others, so a problem in one stays there. Servers and software are patched on a schedule, not when someone remembers, and everything is backed up every night.
Encrypted everywhere, and only for the people who need it
Everything you send to our products travels encrypted (TLS), and everything we store, in every product, is encrypted at rest, including backups. Each organization has its own space: your data is visible only to people in your organization, according to the roles your administrators give them, and never to another organization on the same service. Inside our team, access is limited to the people who need it to run the service.
We never ask for your passwords
When you connect Facebook, Instagram or Google, you sign in through that platform’s own window, so your password goes to them, never to us. If anyone claiming to be from Kavanah asks you for a password, an access code or account access, it isn’t us. Forward it to privacy@kavanahanalytics.com.
Read the code yourself
You don’t have to take our word for any of this. Every product is either open source or available for review in a private repository, so your security team can read the code that handles your data before you trust it with anything. Ask us for access.
Built around duty of care
Many of the people our users serve live where being identified could put them in danger. So the Risk Management platform never stores the names or locations of the local people your teams work with — that is a design rule, not a setting. Kavanah Chat holds messages from the people who write to your team, and we treat those as the most sensitive information we have. We will resist any request for information that could endanger someone, to the extent the law allows.
What we don’t do
We don’t sell your data. We don’t use it for advertising. We don’t share one organization’s data with another. We’re a nonprofit, not a venture-funded company that needs to make money from your data later.
Who you’re trusting
Kavanah Tech is a division of Kavanah Media, a Tennessee nonprofit corporation and 501(c)(3) tax-exempt organization. Where we handle data on behalf of your organization, we do it as your processor: you stay in control of your own information.
More detail, product by product
Kavanah Analytics publishes exactly what it reads from Meta and Google, how long it keeps it and how to delete it, on its own security page and privacy policy. For the other products, the questions your security review needs answered are welcome at privacy@kavanahanalytics.com. If your organization needs a call with someone technical before you sign up, ask — we would rather have that conversation than have you guess.
Reporting a security issue
If you believe you have found a vulnerability in any of our products or websites, please email privacy@kavanahanalytics.com with the subject “Security report” and enough detail for us to reproduce it. Please give us a reasonable chance to fix it before telling anyone else, and don’t access, change or delete other people’s data while testing. We will acknowledge your report and keep you updated while we work on it.