How Kovca protects your data

We don't store your payloads

Request and response bodies are processed in memory to produce a result and are never written to our database. For each request we record metadata only: a request ID, the API and operation, the status code, latency, the API key used, and the time. That's what you see on your Usage page.

API keys

• Keys are generated from 256 random bits using a cryptographically secure generator.
• We store only a SHA-256 hash of each key and a short display prefix. The full key is shown once, when you create it.
• Revoking a key takes effect immediately. See API keys.

Accounts and sign-in

• Sign in with email and password or Google. Passwords are handled by our identity provider and never reach our servers.
• Two-factor authentication with an authenticator app or text message is available in Settings.
• Dashboard sessions use an httpOnly, secure cookie. Changing your password, email, or two-factor settings requires signing in again.
• You can sign out of every device at once, and delete your account and all of its data from Settings.

API protections

• All traffic uses HTTPS.
• Every workspace is rate limited, and request bodies are limited to 16 KB (16,384 bytes). See Errors and limits.
• Inputs are validated against a strict schema before any processing. Error responses never include internal details.
• Every request is scoped to the workspace that owns the API key.

Infrastructure

Kovca runs on Google Cloud through Firebase: the app on App Hosting, accounts on Firebase Authentication, and data in Cloud SQL for PostgreSQL in the United States. Secrets are kept in Secret Manager. To produce results, request content is processed by third-party AI services; it isn't stored by Kovca.

Reporting a vulnerability

If you believe you've found a security issue, email support@kovca.io with the details. Please give us a chance to fix it before disclosing it publicly.