Tenant IDs required at every repository boundary
Implemented as a centralized, testable platform control—not a UI convention.
Security
Trust is part of
the retrieval pipeline.
Kivo is designed for least privilege, explicit tenant boundaries, and privacy-preserving operations from upload through deletion.
Private R2 objects with short-lived upload grants
Implemented as a centralized, testable platform control—not a UI convention.
Collection authorization before retrieval and generation
Implemented as a centralized, testable platform control—not a UI convention.
AES-GCM encryption for workspace-owned model keys
Implemented as a centralized, testable platform control—not a UI convention.
Hashed API keys and invitation tokens
Implemented as a centralized, testable platform control—not a UI convention.
CSP, strict cookies, CSRF and origin validation
Implemented as a centralized, testable platform control—not a UI convention.
Auditable lifecycle jobs and complete scheduled purging
Implemented as a centralized, testable platform control—not a UI convention.
Document text treated as untrusted prompt data
Implemented as a centralized, testable platform control—not a UI convention.