SECURITY

Security at Kaiva Bridge

How Bridge protects your credentials, your data and every tool call your agents make.

  • AES-256

    Stored credentials are encrypted at rest.

  • Per workspace

    Isolated at the database layer.

  • Hash-chained

    Every call is written to a verifiable log.

  • Tool digests

    A changed tool changes the digest.

Read-only by default. Writes when you decide.

Every tool starts switched off, and each one is marked as a read or a write. Database, spreadsheet and document servers can only read: their queries run in read-only transactions, so a tool call cannot change your data.

When you want your AI to do more

APIs can do more than read, so Bridge lets you add writes deliberately, one tool at a time, with guardrails around each one.

  • Turn on write tools one at a time, after you have reviewed them
  • Require a person to approve a write before it runs
  • Try writes in test mode first: writes are simulated, reads are real
  • Every tool call, read or write, is in the audit log with its arguments and result
CONTROLS IN PRODUCTION TODAY

Where each control sits

Your agentMakes a tool call
Managed cloud
Your sourceAPI, database or documents

  • Tool-set attestation

    Every server carries a digest of the exact tool set it serves: names, descriptions and input schemas. If any of them changes, the digest changes.

  • Change detection, not just a tool count

    A tool that keeps its name and has its description or schema rewritten is reported as a contract change, separately from tools being added or removed. That is the case a connected client cannot notice for itself.

  • Tamper-evident history

    Each change is recorded with a timestamp, who caused it and a hash of the one before it. Editing or deleting an entry breaks the chain, and the check is a request you can make yourself.

COMPLIANCE STATUS

Rather than imply certifications we don't hold, here's the honest position, so your security team can plan around it.

  • GDPRAligned

    Aligned. Data Processing Agreement available on request.

  • SOC 2 Type IIIn progress

    In progress, not yet certified.

  • ISO 27001Planned

    Planned, not yet audited.

DPA and sub-processor list available on request, email [email protected].

RESPONSIBLE DISCLOSURE

Found a vulnerability?

We investigate every report. Email [email protected] with details and steps to reproduce, and give us reasonable time to remediate before any public disclosure. Our policy is published at /.well-known/security.txt.

[email protected]