Security & Compliance
AES-256 · TLS 1.3 · Audit log v2026 · v2026.051 · Encryption
All customer data is encrypted with AES-256 at rest and TLS 1.3 in transit. Claim photographs and exports are stored in access-controlled buckets with signed, expiring URLs — nothing is served from a public path.
2 · Access control
Production access requires MFA and is limited to named engineers with a logged reason. Customer data is segregated by tenant; no cross-account queries are possible from the application layer.
3 · Audit trail
Every change to a claim — prices, classes, ages, overrides, exports — is recorded with who, what, and when. The audit trail is append-only and rides with the claim for its lifetime.
4 · Infrastructure
Kevin runs on U.S.-region cloud infrastructure with automated patching, isolated build pipelines, and no customer data in development or staging environments.
5 · Payments
Card processing is handled by our payment processor; card numbers never touch Kevin’s servers. We store only the billing metadata needed for invoices.
6 · Backups & recovery
Data is backed up continuously with point-in-time recovery. Backups are encrypted with the same standard as production data.
7 · Responsible disclosure
Found a vulnerability? Email kevin@kevin.co with reproduction steps. We acknowledge within 2 business days and do not pursue good-faith researchers.
8 · Certifications
We describe our controls concretely rather than by acronym. Ask us anything specific — kevin@kevin.co — and we’ll answer with the actual practice, not a badge.