Security
careful with your customers, your money and your keys
Security in Karvio starts with the shape of the product: your business has its own installation, your payment processor holds the card data, and people approve the things that matter.
isolation by design
- One installation and one database per business
- No shared tenant tables and no vendor back door
- Your credentials live in your own configuration, never in the database
- No remote switch-off, licence check or telemetry
payments and card data
- Customers pay on your payment processor's hosted page
- Card numbers never reach the application or its database
- An append-only ledger: corrections are new entries
- Webhooks verified by signature and applied once
staff access
- Six roles with permissions enforced on the server
- Staff restricted to their own branches, including in reports and exports
- Two-step verification with recovery codes, optionally required for everyone
- Session list, remote sign-out and password reset by single-use link
sensitive actions
- Refunds above your threshold need a second person
- Nobody can approve their own request, enforced in the database as well
- Security settings can require approval too
- Every state-changing action is written to the audit log
customer data
- Private files (licences, inspection photos, agreements) are served only to people allowed to see them
- Guests reach their booking through an unguessable link; accounts are optional
- Full export to CSV for your own records or a data request
- Diagnostic exports contain no customer records
staying recoverable
- Backup and restore scripts for database and files
- A verification script that proves the latest backup restores
- Upgrades back up first and print rollback steps
- A doctor command that refuses unsafe production configuration
What we will not claim
the limits, stated plainly
- Karvio has not been through a third-party security audit or certification. We do not display badges we have not earned.
- You run the installation, so the security of the server, network, backups and staff devices is shared work. The product ships a security guide and a deployment checklist for it.
- There is no single sign-on, and rate limiting beyond sign-in belongs at your reverse proxy.
- Built-in agreement acceptance is an audit trail, not a third-party e-signature, and nothing here is legal advice.
see if it fits your fleet
Tell us about your business. We reply by email, usually with a few questions and an offer to walk you through the product.