Every check, photo and decision belongs to someone’s working day. We’re building protection around that work, with clear answers for the people responsible for reviewing it.
Explore our approach to account access, workspace separation and audit records. Share your security questionnaire so we can address the requirements that matter to your team.
Understand how account access, company workspaces and important changes are handled, with the scope of each control explained below.
Authenticator app setup and verification for web accounts, with sign-in challenges on web and mobile for enrolled users.
Mandatory MFA enrollment for every user is not currently provided. Recovery procedures and deployed identity settings still need verification.
Database rules use account membership to separate company workspaces. Administrator permissions govern sensitive account and team changes.
Production policies and complete coverage across data, files and integrations remain subject to validation.
Security events record who changed selected account, team, site and work records, what changed, and when. Customer field values are excluded.
Application users cannot edit these events. Coverage does not include every read or sign-in; external archival and retention still need configuration.
Browser protections address framing, unsafe cross-origin API writes and caching of API responses. Evidence access uses private storage and signed links.
Live response headers, storage permissions and the production delivery configuration still need verification.
Bring your questionnaire, requirements and any contractual questions. We’ll work through the requested controls and identify the evidence needed for your decision.
Start a security review Opens an email to support@kivloo.com.Send your questionnaire and the controls, data-handling needs or commitments your team wants to assess.
We have prepared answers covering access, vendors, data handling, logging and recovery, with scope and verification steps.
Deployment status, operating evidence and contractual commitments are reviewed before a final response. No assumed certifications or service guarantees.
Security review materials support a conversation. They do not replace independent assurance or agreed service terms.
Yes. We have prepared responses covering account access, data handling, audit records, infrastructure, vendors and recovery. Send your questionnaire and requirements to our team. We review the requested claims and distinguish implemented controls from items that still need operational evidence. Internal drafts are not an independent assurance report.
Kivloo does not currently offer an independent SOC 2 report. Contact us to review our security controls and available documentation against your requirements.
Authenticator enrollment and verification are implemented for web accounts, with sign-in challenges on web and mobile for enrolled users. Mandatory enrollment for every account is not currently provided. Production identity settings and account recovery still require validation.
Data location, backup arrangements, retention and deletion need to be confirmed for the deployed service and agreed terms. A workspace preference does not establish data residency. We do not publish a universal residency, retention, recovery-time or uptime guarantee.
AI features use Anthropic and may send the prompts and context needed for the requested feature. Provider processing, retention and training terms need to be reviewed against your requirements. We do not claim zero retention or a verified no-training commitment here.
Prepared drafts and photos can remain on the same browser or device while waiting to sync. A local save does not mean a record has reached the shared workspace. Browser offline data is not application-encrypted; device access, loss and offboarding requirements should be included in your review.
Kivloo supports consistent checks and organised evidence. Your obligations also depend on applicable requirements, approved procedures and actual working practices. A completed checklist, score or AI draft does not certify compliance or guarantee an inspection outcome.
Open Settings → Security → Enterprise security review in your account. Administrators can review the prepared answers and export a CSV. Each answer includes its evidence references and outstanding checks.
Open your security reviewExplore how checks, photos and observations come together in an example inspection record.
Visit the example record room