Security
Trust is part of the retrieval pipeline.
Kivo is designed for least privilege, explicit tenant boundaries, and privacy-preserving operations from upload through deletion. Each control is implemented as a centralized, testable platform control—not a UI convention.
01Tenant IDs required at every repository boundary
02Private R2 objects with short-lived upload grants
03Collection authorization before retrieval and generation
04Fail-closed service authentication between Workers
05Hashed invitation tokens and verified-email admin gating
06CSP, strict cookies, CSRF and origin validation
07Immediate multi-store purging on deletion
08Document text treated as untrusted prompt data