Security

Read-only by design

Kavrenix connects to your servers via SSH and executes only read commands. We read from /proc/stat, /proc/meminfo, /proc/net/dev, and run standard utilities like ps, df, ss, and docker stats.

We never write files, install packages, modify configurations, or execute arbitrary commands. Our entire command set is open and auditable.

No agent architecture

Unlike traditional monitoring tools, Kavrenix installs nothing on your servers. There is:

• No daemon running on your machine
• No package to update or maintain
• No open port required on your server (SSH only)
• No root access required (any user with read access to /proc works)

Revoke the SSH key and monitoring stops instantly. Zero cleanup needed.

Credential security

• SSH private keys are encrypted with AES-256-GCM before storage
• Encryption keys are rotated and never stored alongside the encrypted data
• Credentials are decrypted in memory only during active connections
• Database connections use TLS in transit
• All API traffic is served over HTTPS with TLS 1.3

Infrastructure

• Hosted on AWS (ap-south-1 region)
• Application runs in isolated Docker containers with resource limits
• Database encrypted at rest
• Automated backups with 30-day retention
• Non-root container processes (principle of least privilege)

Access control

• Role-based access: Admin, User, Viewer roles per company
• JWT-based authentication with short-lived tokens
• Session management with concurrent session limits
• Rate limiting on all API endpoints
• Audit logging for all administrative actions

Data isolation

Each customer gets a dedicated, isolated database. Your data is never co-mingled with other customers. This provides strong tenant isolation at the database level — not just application-level filtering.

Responsible disclosure

If you discover a security vulnerability, please report it to security@kavrenix.com. We take all reports seriously and will respond within 48 hours.