Security & trust

Overview

Inkvo is a telemetry-processing platform. We ingest traces, metrics, logs, and deploy events, derive incidents from them, and deliver narratives. Security is not a feature bolted on — the same isolation and least-privilege model that keeps a prod key from writing to staging is what keeps your data yours.

Compliance & SOC 2

Inkvo maintains a SOC 2 Type II attestation covering Security, Availability, and Confidentiality, audited annually by an independent firm. Healthcare customers can execute a HIPAA Business Associate Agreement before sending PHI-adjacent telemetry.

The current SOC 2 report, penetration-test summary, and our security whitepaper are available to customers and prospects under NDA. Request them through your account team or the contact below.

Encryption

• In transit: TLS 1.3 on every connection, including OTLP ingest over HTTP and gRPC. HSTS is enforced; older protocol versions are rejected.
• At rest: AES-256 on all stored telemetry, metadata, and backups. Keys are managed in a cloud KMS with annual rotation.
• Secrets: Ingest keys are stored hashed; the plaintext is shown exactly once at creation. Internal service credentials are short-lived and issued per workload.

Access control

Internal access to customer data follows least privilege and is broken-glass only: an engineer cannot read your telemetry without an audited, time-boxed grant tied to a support ticket. All such access is logged and reviewed.

• SSO (SAML / OIDC) and SCIM provisioning on Business plans
• Role-based access within a workspace; scoped API keys per environment
• Mandatory hardware-key MFA for all Inkvo staff

Infrastructure

Inkvo runs on a major cloud provider across multiple availability zones, with regional isolation between us and eu tenancy. Production is fully isolated from staging and corporate networks. Infrastructure is defined as code and changes go through peer review and automated policy checks before deploy.

Live operational health is published on our status page — the same narrative tooling we sell, watching our own stack.

Data handling & DPA

You own your data. We process it solely to provide the service. A Data Processing Agreement incorporating the SCCs is available on request and is countersigned for all Business customers and any EU/UK customer who asks.

• Retention follows your plan (14 / 90 days, or custom) and your configuration. Deleted data is purged from primary storage immediately and from backups within 35 days.
• Deletion on account closure removes all telemetry and derived incidents within 30 days; certified deletion available on request.
• Minimization: Inkvo needs metadata and metrics, not payloads. We encourage scrubbing PII from spans at your collector before ingest.

Subprocessors

We use a short list of subprocessors to deliver the service. Customers can subscribe to notifications of changes with 30 days' notice.

Vulnerability disclosure

Found something? We want to hear it. Email security@inkvo.dev with details and reproduction steps. We acknowledge reports within one business day, do not pursue good-faith researchers, and credit reporters who want it. A coordinated-disclosure window is agreed per report.