Security for your operational data.
Klovio is SOC 2 Type II audited. This page summarizes our documented controls. Request the full documentation for your vendor assessment; it states which products and services each control covers.
Encryption
- At rest: AES-256 encryption for data on disk, including backups. Keys are managed in AWS KMS and rotated regularly.
- In transit: TLS 1.3 for client-to-server and server-to-server traffic. Older protocols (TLS 1.0 and 1.1, SSLv3) are disabled at the load balancer.
- Application secrets: stored in AWS Secrets Manager, and not written to disk or logged in plain text.
Infrastructure
- Hosted in AWS (us-east-1 by default, eu-west-1 for EU customers).
- Multi-AZ deployments with automated failover.
- Hourly database backups with 30-day point-in-time recovery.
- Daily backup verification with automated restore tests.
- DDoS protection through AWS Shield Standard and Cloudflare.
Access control
- Role-based access: preset roles in each product, such as Receiver, Picker, Packer, Manager and Admin in WMSHero, plus custom roles.
- Single sign-on: SAML 2.0 with Okta, Azure AD, Google Workspace, OneLogin or JumpCloud, on the Custom plan.
- SCIM provisioning to automate user setup and removal, on the Custom plan.
- Two-factor authentication for users on all plans.
- API keys are scoped, revocable and tied to a single role.
Audit logging
Actions that change data, including scans, edits, adjustments, transfers and permission changes, are logged with a timestamp, user ID, source IP address and device. Logs are append-only and can be exported as audit evidence.
Vendor security
We use a small set of subprocessors, including AWS, Stripe, Sentry, Linear and Slack. The current subprocessor list, with the security assurance each vendor provides, is available on request with our DPA.
Vulnerability disclosure
To report a vulnerability, email support@klovio.app with the details. This contact is also published at /.well-known/security.txt. We acknowledge reports within 24 hours and aim to fix critical issues within 72 hours.
Incident response
We maintain a documented incident response plan that is reviewed quarterly. Customers affected by a security incident are notified within 72 hours, as set out in our DPA. Service incidents are posted to klovio.app/status.
Request our documents
Available on request from support@klovio.app:
- SOC 2 Type II report (under NDA)
- Data Processing Agreement (DPA)
- Subprocessor list
- Penetration test summary
- Business Associate Agreement (HIPAA)
Security questions during your review?
Contact our team to discuss your security requirements and request the documentation you need.