Serious about money. Boring about data.

How Kovern is built

• Money and cards live at Stripe. Cards are issued and customer funds are held through Stripe and its regulated banking partners. Stripe is PCI DSS Level 1 certified. Kovern stores the last four digits of a card and nothing else about it.
• Every charge is decided in real time. When a card is used, the network asks Kovern for an answer inside the authorization. Kovern checks the vendor policy and the person's budget on our servers and answers approve or decline. Nothing is decided in the browser.
• One company per tenant. Every record is keyed to the company that owns it. Sign-in resolves to one company, and every read, write, and download link is scoped to it.
• Roles. Owners and admins manage people, budgets, policies, and funding. Employees see only their own card, budget, and subscriptions. Kovern staff tooling is limited to a named allowlist and is itself audit-logged.
• Audit log. Every administrative action (cards, budgets, policies, funding, offboarding, exports) is written to a per-company audit log that ships with the JSON export.

What we hold, and what we don't

• We hold: company details you enter, the people you add (name, work email, title, budget, optional phone), card authorizations and transactions as reported by the network, subscriptions Kovern detects from those transactions, your policy choices, and the audit log.
• We never hold: full card numbers, CVCs, bank logins, or your team's prompts, files, and outputs inside AI tools. Kovern watches the charge, not the work.
• Identity checks. Business verification runs on Stripe. Once a company is verified, Kovern discards the tax ID it collected for that step.
• Google Workspace. Only if you connect it, and only two scopes: read users (for the directory) and read sign-in audit events (for “last used”). You grant it in your own Admin console and can revoke it there at any time.

Retention and deletion

• Financial records are kept for seven years, as required for card programs.
• Raw webhook payloads are deleted after 90 days by a scheduled job.
• Kovern v8 support transcripts are kept while a ticket is open and for 12 months after it closes.
• You can export everything as JSON from Settings at any time. Account deletion requests go to hello@kovern.ai and are completed within 30 days, financial records excepted.

Transport, hosting, and secrets

• HTTPS everywhere with HSTS preload on kovern.ai and app.kovern.ai. Security headers on every response.
• The database sits on a private network with no public address. Only Kovern's own services can reach it.
• Secrets live in the hosting platform's encrypted environment, never in code. Every commit is scanned for keys before it leaves a laptop.
• Webhooks from Stripe are signature-verified. Money movement uses idempotency keys so a retried request can never double-fund or double-charge.

Access control

• Sign-in runs on Clerk with Google sign-in, email codes, or a password. Two-step verification with an authenticator app or passkey is available to every account and Kovern prompts owners and admins to turn it on.
• Staff access to customer accounts is limited to a named allowlist, used only for support you have asked for, and recorded in the audit log.

Subprocessors

Third parties that process customer data on Kovern's behalf. We will update this list at least 30 days before adding one that handles personal data.

Incident response

If we confirm an incident affecting your data, we notify the account owner by email within 72 hours of confirmation with what happened, what was affected, and what we did. Stripe and Clerk carry their own incident commitments for the pieces they run.

Compliance status

• Stripe: PCI DSS Level 1 service provider. Stripe's reports are available from Stripe.
• Clerk: SOC 2 Type II. Clerk's report is available from Clerk.
• Kovern: SOC 2 Type I is on the roadmap for after launch, with an independent penetration test before real money moves through live cards. We will publish results here and share reports under NDA on request.

Report a vulnerability

Found something? Email hello@kovern.ai with steps to reproduce. We acknowledge within two business days, keep you posted while we fix it, and will not pursue good-faith research that avoids customer data and service disruption. Machine-readable details are at /.well-known/security.txt.

Agreements

Our privacy policy, terms, and data processing addendum. Business customers who need a signed DPA can request one at hello@kovern.ai.