Security & Compliance
Kolva is built with enterprise-grade security from the ground up. Your data is protected by multiple layers of defense, strict access controls, and continuous monitoring.
Certifications & Compliance
SOC 2 Type I
Type I planned — Type II to follow. Service Organization Control audit covering security, availability, and confidentiality.
GDPR Compliant
Full compliance with the EU General Data Protection Regulation. DPA available for all customers.
CCPA Compliant
California Consumer Privacy Act compliance. Data access, deletion, and opt-out rights fully supported.
Security Measures
Encryption
- TLS 1.3 for all data in transit
- AES-256 encryption at rest
- Cloud KMS envelope encryption for stored ERP integration credentials
- SHA-256 hashing for developer API keys
Access Control
- Role-based access control (RBAC) with 5 permission levels
- Row-Level Security (RLS) enforced at database level
- Strong authentication via your identity provider (SAML SSO)
- Session tokens with short expiry and rotating refresh
Infrastructure
- Hosted on SOC 2 certified infrastructure (AWS/Vercel)
- Database hosted in the EU (AWS eu-west-1, Ireland)
- Platform-managed automated backups with point-in-time recovery
- Managed infrastructure with provider-level redundancy
Monitoring & Response
- Continuous application and error monitoring (Sentry)
- Scheduled data-integrity and anomaly detection with alerting
- Contractual breach notification commitments (see DPA)
- Continuous security audit: automated route manifest in CI + independent adversarial reviews
Development Practices
- Secure development lifecycle (SDLC)
- Automated dependency vulnerability scanning
- Code review required for all changes
- Staging environment testing before production
AI Security
- Customer data never used for AI model training
- AI processing via encrypted API under negotiated enterprise terms
- AI features can be disabled per-account
On-Premise Agent Security
Kolva connects to your ERP (Sage X3, SAP Business One) via a lightweight agent that runs entirely on your corporate network. The agent is strictly read-only — it extracts data and sends it to Kolva over HTTPS. It never writes, modifies, or deletes anything in your ERP.
Unidirectional Data Flow
No write path exists from Kolva to your ERP. The data flow is strictly one-way.
Read-only by design
The agent never writes to your ERP: no INSERT, UPDATE or DELETE against ERP tables anywhere in the codebase — business data is read through SELECT queries (Sage X3) and GET requests (SAP). The agent does issue outbound HTTPS POSTs to deliver data to Kolva, and some connectors use POST for session login (e.g. SAP Service Layer); neither mutates your ERP. This is architecturally enforced — not just a policy.
Runs on your network
The agent runs entirely within your corporate network. It connects to your ERP locally and sends data outbound to Kolva over HTTPS. No inbound ports are opened, no VPN tunnels are required.
SQL read-only account
We recommend connecting the agent with a dedicated SQL user that has only SELECT permissions. Even if the agent code were modified, the database account physically cannot write or delete data.
Auditable source code
The full agent source code is available for review by your IT team before deployment. Unlike proprietary ERP connectors, you can verify every SQL query and HTTP call the agent makes.
Your ERP credentials stay under your control
Your ERP credentials (SQL login, SAP API key) live in the agent's .env file on your server. If you use the guided setup wizard, they are sealed with cloud KMS envelope encryption before being stored so Kolva can provision the agent; a strictly local configuration remains available. Authentication to Kolva uses a separate, revocable API key.
Data stored in EU
All synchronized data is stored in a PostgreSQL database hosted on AWS eu-west-1 (Ireland). The synchronized database stays in the European Union, encrypted at rest with AES-256. Selected sub-processors listed below may process data elsewhere under contractual safeguards.
How Kolva Compares to Industry Standards
Kolva follows the same security standards as Sage and SAP for third-party integrations, with the added benefit of full source code transparency.
| Security Feature | Kolva | Sage X3 | SAP B1 |
|---|---|---|---|
| Read-only access | SELECT / GET hardcoded | Read-only API representations | Authorization levels (Read-Only) |
| Encryption at rest | AES-256 | AES-256 | AES-256 |
| Encryption in transit | TLS 1.3 | TLS 1.2+ | TLS 1.2+ |
| Data location | EU (Ireland) | On-premise or Sage cloud | On-premise or SAP cloud |
| Certifications | SOC 2 (infra), GDPR | SOC 1/2, ISO 27001 | ISO 27001, SOC 1/2 |
| Source code audit | Full source available | Proprietary | Proprietary |
| Credential storage | Local .env, or cloud KMS-encrypted via guided setup | Varies by connector | Varies by connector |
Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database & Authentication | EU (AWS Ireland) |
| Vercel | Application Hosting | EU (Dublin) — global edge CDN |
| Stripe | Payment Processing | US |
| Resend | Transactional Email | US |
| Inngest | Background Job Orchestration | US |
| Anthropic | AI assistants (Claude) | US |
| OpenAI | Embeddings, transcription, voice coach | US |
| ElevenLabs | Speech synthesis (Academy audio) | US |
| Sentry | Error and performance monitoring | US |
| Upstash | Rate limiting (Redis) | Global |
| Google Maps Platform | Geocoding and maps | Global |
| Google Cloud KMS | Key management for credential encryption | EU |
Last updated: February 28, 2026. We notify customers 30 days before adding new sub-processors.
Responsible Disclosure
We value the security community. If you discover a vulnerability, please report it responsibly. We commit to acknowledging reports within 24 hours, providing updates within 72 hours, and resolving critical issues within 7 days.
security@kolva.ai