Security at Kaiva Bridge
Bridge connects your agents to your databases and APIs, so it handles credentials and relays traffic. The controls below are in production today.
CREDENTIALS
Credential isolationUpstream database passwords and API tokens are decrypted only inside the request path. Agents receive results, never the credential.
Encryption at rest and in transitStored credentials are encrypted at rest with AES-256; all traffic is encrypted in transit with TLS, and encryption keys can be rotated.
NETWORK & ISOLATION
Egress protection (SSRF)Bridge only connects out to the public endpoints you point it at. It can't be turned around to reach your internal network.
Tenant isolationEach workspace is logically isolated at the database layer; one customer cannot access another's servers, keys, or logs.
ACCESS & AUDIT
Access controlExpose only the tools an agent may call; mark them read-only or require approval before any write. API keys are scoped per server.
Audit loggingEvery call is written to an append-only, hash-chained log that can be verified, exported, or streamed to a SIEM.
Data-loss preventionSensitive values — emails, cards, secrets — can be masked or blocked in tool responses before they reach the agent.
HOSTING & DATA
HostingBridge runs on Kaiva's managed cloud, hosted on SOC 2-audited infrastructure (Kaiva's own SOC 2 is in progress). Enterprise can run on-prem or in your own cloud.
Data usageCustomer data and traffic are not used to train foundation models.
COMPLIANCE STATUS
Rather than imply certifications we don't hold, here's the honest position — so your security team can plan around it.
GDPRAligned. Data Processing Agreement available on request.
SOC 2 Type IIIn progress — not yet certified.
ISO 27001Planned — not yet audited.
DPA and sub-processor list available on request — email [email protected].
RESPONSIBLE DISCLOSUREFound a vulnerability?We investigate every report. Email [email protected] with details and steps to reproduce, and give us reasonable time to remediate before any public disclosure. Our policy is published at /.well-known/security.txt.