Your Data, Protected
Klyverity is built with security at its core. We use industry-leading practices to ensure your sensitive documents and signatures are protected at every step.
Bank-Level Encryption
Your documents and data are encrypted using the same standards trusted by financial institutions and government agencies worldwide.
Every document, database volume and backup is encrypted with AES-256 before it is written to disk
Your browser connects to our CDN edge, which negotiates TLS 1.3 when your browser supports it and TLS 1.2 otherwise. TLS 1.2 is the floor everywhere: the edge refuses the legacy TLS 1.0 and 1.1 outright, and our load balancer accepts only TLS 1.2 and above, and only from the CDN. Inside our private network, the hop from the load balancer to the application is not separately TLS wrapped
Klyverity holds the encryption keys, so this is not end-to-end encryption. Holding them is what lets the platform render, hash and seal your documents on your behalf
Database snapshots and transaction logs are encrypted under the same AWS managed key as the live database volume
Encryption Standards
Data at Rest
AES-256256-bit Advanced Encryption Standard
Data in Transit
TLS 1.3 / 1.2TLS 1.3 preferred, TLS 1.2 the minimum accepted. The CDN edge and our load balancer both refuse anything older
Document Hashing
SHA-256Cryptographic hash for integrity verification
Key Management
AWS managedDatabase volumes and application secrets use AWS managed KMS keys. Documents use S3 managed keys. There are no customer managed keys today
Infrastructure
Multi-AZ Deployment
Runs in one AWS region, us-east-1, spread across two availability zones, with the database kept on a standby in the second zone and failed over automatically. There is no second region.
Separated Network Tiers
The load balancer sits in a public subnet. The application and the database sit in private subnets with no route in from the internet, and each tier has its own security group: the application accepts connections only from the load balancer, and the database only from the application.
DDoS Protection
Cloudflare fronts every request to our API and absorbs volumetric attacks at its edge. The load balancer behind it accepts connections only from Cloudflare's published address ranges, so the origin cannot be reached directly. AWS Shield Standard, which AWS applies to every customer automatically, covers the AWS side. We are not subscribed to Shield Advanced.
Scanned Container Images
Application images live in a private registry with immutable tags, so a released tag can never be overwritten, and every push is scanned for known vulnerabilities.
AWS Certifications and Attestations
These are Amazon's certifications and attestations for the infrastructure Klyverity runs on, not Klyverity's own. Klyverity does not itself hold a SOC 2 attestation or an ISO 27001 certification. HIPAA is not a certification: AWS offers HIPAA eligible services under a business associate agreement, which we hold. We can provide the AWS reports, our validation documentation and a completed security questionnaire on request.
Built on AWS
The parts of Klyverity that hold your data run on Amazon Web Services: the API, the database, document storage and the scheduled background jobs. Two other providers sit in the path. Vercel serves this website and the application front end, and Cloudflare sits in front of the API as its edge. Both are listed in our privacy policy.
Comprehensive Access Controls
Control who can access your documents and what they can do with granular permissions and robust authentication options.
Two-Factor Authentication
2FA is mandatory, not an option an administrator turns on: every account must complete setup before it can use the platform, and signing requires its own separate verification on top of that. Verification is by authenticator app (TOTP), with one-time backup codes as the recovery path.
Role-Based Access
Define roles with specific permissions. People join an organization as an owner, admin, member or guest, and each participant in a workflow is separately assigned as author, reviewer, approver, signer or CC.
Session Management
Sessions end after 15 minutes of inactivity and expire 12 hours after sign-in whatever happens. Concurrent sessions per person are capped, and a session can be revoked remotely. We do not offer single sign-on today.
Password Policies
Passwords must be at least 12 characters and no more than 128, and must combine upper case, lower case, a digit and a symbol.
Audit Logging
Sign-in attempts, successful or failed, go to a security event log that records a one-way hash of the IP address and the email rather than the values themselves, and those records are deleted outright at 90 days. Document actions are recorded separately in the Part 11 audit trail, where the entry is kept for the life of the record and only its raw IP address is cleared at 90 days.
Email Verification
All user accounts require email verification before accessing sensitive features.
Proactive Security
We do not just build secure systems, we check them every day with automated controls that run on a schedule and page us when they fail. To be direct about the limit of that: no independent penetration test and no third-party security audit have been carried out on Klyverity yet. Both are planned, and this page will say so once they are done.
Hash Chain Audit Trail
Every action is logged into a SHA-256 hash chain, each entry carrying the hash of the one before it, so a changed or removed entry breaks the chain visibly. The database itself refuses the change: triggers on the audit tables reject every DELETE, and reject every UPDATE except the single IP erasure described below. Immutability does not depend on application code behaving.
Daily Integrity Verification
A scheduled job re-walks the whole hash chain for every active organization each morning, writes the result to storage as evidence that the check ran, and pages us on any result that is not clean. An independent copy of each entry hash is kept separately from the audit table itself.
Signing 2FA
Two-factor authentication is required before a signature is applied, using a TOTP authenticator app, with one-time backup codes as the recovery path. The verification goes stale after five minutes, so an old check cannot carry a later signature.
Comprehensive Logging
Document and workflow actions are recorded in the Part 11 audit trail with timestamp, user, IP address and device information. Sign-in attempts are recorded separately in a security event log that stores a one-way hash of the IP address and the email rather than the values themselves.
Automatic IP Erasure at 90 Days
A job runs daily and blanks raw IP addresses older than 90 days across sessions, the audit trail, signer records, subscription events and blocked-access records, citing GDPR Article 5(1)(e). One address is deliberately exempt: the IP captured at the moment a signature is executed is part of the Part 11 signature manifestation and is kept for the life of the signature record, so that signature evidence stays complete, and it is printed on the Certificate of Completion attached to the finished document where every party to that document can see it. The audit trail is the interesting case: its immutability trigger permits the IP field to be set to null and nothing else, and raises an error if any other column differs by so much as a byte. Data minimization without a hole in the Part 11 record.
Long-Term Log Archival
Each day the previous day's application and background-job logs are exported to a dedicated storage bucket that moves them to Glacier after 90 days and Deep Archive after a year, and never expires them, for FDA 21 CFR Part 11 retention.
Monitoring and Alerting
CloudWatch alarms cover the application, load balancer and database and route to an alert topic. Two of them are set to fire on a count above zero, meaning a single audit-trail write that failed and was swallowed pages us, because a missing Part 11 record is not something to notice in aggregate. Application errors also go to Sentry.
Security Headers
Responses carry HSTS with a one-year max-age and preload, a Content Security Policy that forbids framing entirely, plus nosniff, a referrer policy and a permissions policy that switches off camera, microphone, geolocation and payment.
Encrypted Backups
Daily automated database snapshots plus continuous transaction logs, encrypted with AES-256 and retained for 14 days, with point-in-time recovery anywhere inside that window. There is no weekly or monthly archive tier.
Incident Response
In the unlikely event of a security incident, we have a documented response plan. It sits alongside written procedures for access control, encryption, logging and monitoring, network security, vulnerability management, backup and recovery, breach notification and change management. The plan itself runs in five phases; in outline:
Detection & Analysis
Identify and assess the scope of the incident
Containment
Isolate affected systems to prevent spread
Notification
Notify affected customers without undue delay, and no later than 72 hours after we confirm a breach, so you can meet your own reporting deadlines
Recovery & Review
Restore services and conduct post-incident analysis
Security Contact: Report security concerns to security@klyverity.com
Your Data is Safe
We use several layers of protection to keep your data available, recoverable and out of reach of anyone who should not have it.
Automated Backups
Continuous backups with point-in-time recovery. Your data lives in one region, us-east-1, with a standby in a second availability zone. There is no cross-region replication.
- • Daily full backups
- • Continuous transaction logs
- • 14-day backup retention
- • Multi-AZ standby within the region
Business Continuity
Designed for 99.9% uptime, which is what our terms commit to on paid plans, backed by service credits. Database failover between availability zones is automatic.
- • Multi-AZ deployment
- • Automatic database failover
- • Point-in-time recovery within the 14 day window
- • No published recovery time or recovery point target, because we have not yet completed a documented restoration test
Data Deletion
Deleting a document is a soft delete: it is removed from your views and marked deleted, and the stored file is not erased. Closing an account does not delete data. Deletion beyond that is a manual request we handle case by case.
- • Soft delete, with no automatic purge afterwards
- • Signed documents locked during their retention period
- • Audit trail entries can never be deleted, and cannot be edited apart from the 90 day IP erasure, enforced by the database itself
- • Backups and prior file versions persist separately
Data Isolation
Each organization's data is logically isolated. Your data is never accessible to other customers.
- • Every read and write is scoped to your organization's identifier
- • Enforced in the application layer, not by database row level security
- • One shared database and application tier, separated per organization by that scoping rather than by separate infrastructure
- • Audit logging per organization
Compliance & Infrastructure
Klyverity is built on AWS infrastructure and designed to meet regulatory requirements for electronic signatures in regulated industries.
AWS Infrastructure
Hosted in AWS data centers covered by a SOC 2 Type II attestation, with enterprise-grade security
GDPR Support
Processor-focused controls and assistance for EU data protection obligations
FDA 21 CFR Part 11
Designed to meet electronic signature requirements for regulated industries
For detailed compliance documentation, please contact us.
Ready to Get Started?
Join organizations that trust Klyverity for secure, compliant electronic signatures.