Security is Our Top Priority

SOC 2 Type II

Annual third-party audit verifying our security, availability, processing integrity, confidentiality, and privacy controls.

GDPR Compliant

Full compliance with the EU General Data Protection Regulation including DPA, data subject rights, and transfer mechanisms.

HIPAA Ready

Healthcare customers can sign a BAA. Our platform supports HIPAA-compliant deployment configurations for protected health information.

ISO 27001

Information security management system certified to ISO/IEC 27001:2022 international standard.

AWS Infrastructure

Hosted on Amazon Web Services the world's most secure and reliable cloud provider. We leverage AWS Shield, WAF, and Security Hub.

Multi-Region

Data replicated across multiple AWS regions for disaster recovery, data residency compliance, and low-latency access worldwide.

99.99% Uptime SLA

Enterprise SLA with financial-backed guarantees. Real-time status at status.konvoq.ai. Automatic failover in under 30 seconds.

AES-256 at Rest

All stored data conversations, configs, user records encrypted using AES-256-GCM, the same standard used by financial institutions.

TLS 1.3 in Transit

All data transmitted using TLS 1.3 with perfect forward secrecy. Older cipher suites are disabled. HSTS enforced across all endpoints.

Zero-Knowledge Architecture

Conversation data is processed ephemerally for AI responses. We do not train our models on your private conversations without explicit consent.

SSO / SAML 2.0

Single sign-on via SAML 2.0, OAuth 2.0, and OIDC. Integrates with Okta, Azure AD, Google Workspace, and any SAML-compliant IdP.

Role-Based Access Control

Granular RBAC with custom roles. Assign permissions at the workspace, project, and resource level. Full audit trail of all access events.

MFA Enforcement

Require MFA for all team members. Supports authenticator apps (TOTP), hardware keys (FIDO2/WebAuthn), and SMS fallback.

<1h

Incident Response Time

Public Status Page

Quarterly Penetration Testing

We engage independent, certified third-party security firms to conduct comprehensive penetration tests every quarter covering our web application, API, infrastructure, and mobile surfaces.

Vulnerability Disclosure Program

We welcome responsible disclosure of security vulnerabilities from the security research community. Researchers who report valid findings are recognized in our Hall of Fame.