inkvo
Log inStart free
inkvo/security

Security & trust

You're sending us your telemetry — the nervous system of your product. Here's exactly how we protect it, who can touch it, and how to tell us if something's wrong.

Encryption in transit & at restGDPR · DPA on request

Overview

Inkvo is a telemetry-processing platform. We ingest traces, metrics, logs, and deploy events, derive incidents from them, and deliver narratives. Security is not a feature bolted on — the same isolation and least-privilege model that keeps a prod key from writing to staging is what keeps your data yours.

We read, we don't store your source

Inkvo never clones your repositories or holds production credentials. Deploy correlation uses commit SHAs and metadata you send us — not access to your code.

Encryption

  • In transit: TLS on every connection, including OTLP ingest over HTTP and gRPC. HSTS is enforced and legacy protocol versions are disabled.
  • At rest: stored telemetry, metadata, and backups sit on encrypted disks.
  • Secrets: ingest keys are stored hashed — the plaintext is shown exactly once, at creation — and application secrets are kept out of source control.

Access control

Access to customer data follows least privilege: it's limited to what's needed to operate and support the service, and such access is logged.

  • Role-based access within a workspace; scoped API keys per environment
  • SSO (SAML / OIDC) on Business plans — coming soon
  • MFA required on administrative access

Infrastructure

Inkvo runs on European cloud infrastructure. Production is isolated from staging and from our corporate systems, and infrastructure is managed as code so changes are repeatable and reviewable.

Live operational health is published on our status page — the same narrative tooling we sell, watching our own stack.

Data handling & DPA

You own your data. We process it solely to provide the service. A Data Processing Agreement incorporating the SCCs is available on request and is countersigned for all Business customers and any EU/UK customer who asks.

  • Retention follows your plan (3 / 30 / 90 days, or custom) and your configuration. Deleted data is removed from primary storage promptly and ages out of backups shortly after.
  • Deletion on account closure removes your telemetry and derived incidents within 30 days.
  • Minimization: Inkvo needs metadata and metrics, not payloads. We encourage scrubbing PII from spans at your collector before ingest.

Subprocessors

We use a short list of subprocessors to deliver the service — for payments, authentication, hosting, and generating incident narratives. The current list, with each subprocessor's purpose, is maintained in our Privacy Policy. Customers can request advance notice of changes under the DPA.

Vulnerability disclosure

Found something? We want to hear it. Email security@inkvo.dev with details and reproduction steps. We acknowledge reports within one business day, do not pursue good-faith researchers, and credit reporters who want it. A coordinated-disclosure window is agreed per report.

Security questions before you buy?

Reach your account team or email security@inkvo.dev for the DPA and a security overview.