Procurement
Vendor Profile & RFI Responses
Pre-answered responses to the questions vendor questionnaires ask most often — company, architecture, identity, data protection, security, compliance, AI, availability, and commercial terms.
Last updated: July 28, 2026
This document answers the questions standard vendor questionnaires ask most often, so a procurement or security team can complete an RFI without scheduling a call. Answers are short by design and link to the document that carries the detail.
A completed SIG or CAIQ, or your own questionnaire, can be returned on request. Artifacts released under NDA — audit reports, penetration-test summaries — are requested from /trust.
1. Company & product
| Question | Response |
|---|---|
| What is the legal contracting entity? | The contracting entity, registration details, and registered address are stated on the order form and provided on request. Contact /contact for commercial questions or security@kavanah.ai for security and privacy questions. |
| What is the product? | Kavanah is an AI-native work-management platform: projects and tasks, team collaboration, client and portfolio management, engineering delivery, and a governed AI agent that can act across all of it. Functional scope is in the Capabilities Matrix. |
| What product category does it fall into? | Work management / project management with an integrated AI agent. It is typically evaluated against project-management and collaboration tooling rather than against point AI products. |
| Who are the target customers? | Teams and organizations running client or internal delivery work — agencies, professional-services teams, and product and engineering organizations. Kavanah is in an early-access phase; see /references for how customer references are handled. |
| What is the deployment model? | Multi-tenant SaaS, operated by Kavanah. There is no self-hosted or on-premise deployment option. |
| Which platforms are supported? | Web, desktop (macOS, Windows, Linux), and mobile (iOS, Android). All three shells are built from one codebase, so features and security controls stay consistent across devices. |
| What languages is the interface available in? | English. |
| Where is the product documentation? | User, administrator, and API documentation all live at /docs — the API reference is the Developer API tab there, and the machine-readable specification is published at /openapi.yaml. Requirement- and specification-level documents are at /frd and /fsd. |
2. Architecture & hosting
| Question | Response |
|---|---|
| Who hosts the service? | The application runs serverless on Vercel with a managed Neon Postgres database. Both providers operate SOC 2-audited data centers. |
| Where is production data processed? | In the United States. Residency controls are available in-product; regional requirements should be raised before contracting. |
| What is the tenancy model? | Multi-tenant with logical isolation. Every workspace-scoped query carries a workspace filter, enforced by a CI linter that fails the build if one is missing — see /architecture. |
| Is a single-tenant or on-premise deployment available? | No. Kavanah is offered only as multi-tenant SaaS today. |
| What database technology is used? | Managed PostgreSQL (Neon) for application data, running behind the serverless application tier on Vercel. Per-edition file storage allowances are listed on the Pricing Sheet. |
| How are updates delivered? | Continuously, to all customers, with no customer-side upgrade step. Changes go through peer-reviewed change management and an automated CI pipeline before release. |
| Are sub-processors disclosed? | Yes. The current list is published at /sub-processors. |
3. Identity & access management
| Question | Response |
|---|---|
| What authentication methods are supported? | Email and password with bcrypt hashing, OAuth sign-in with Google and GitHub, and enterprise single sign-on. Sessions use signed JWTs validated server-side on every request. |
| Which SSO protocols are supported? | SAML 2.0 and OpenID Connect (OIDC). |
| Is multi-factor authentication available? | Yes — TOTP authenticator apps and WebAuthn passkeys / security keys, challenged on every sign-in path (password, Google/GitHub and SSO). Where SSO is in use, the identity provider's own MFA policy also applies. |
| How are users provisioned and deprovisioned? | Through SCIM directory sync, or through workspace invitations and member management in the admin UI and API. Removing a member revokes their workspace access immediately. |
| What is the role model? | Owner, admin, member, and client-portal roles, layered with granular capability scopes and per-project and per-task access control. |
| Can permissions be granted below the workspace level? | Yes. Access can be scoped to individual projects and tasks in addition to role, so external or partial-access users see only what they are entitled to. See /capabilities. |
| How is the API authenticated? | Workspace API keys prefixed kvn_live_. A key inherits the permissions of the user who minted it, so it can never exceed that user's access, and keys can be revoked at any time. |
| How are sessions handled? | Sessions are signed JWTs validated server-side; they expire and can be revoked. Administrative and sensitive actions are recorded in the audit log with the acting identity. |
4. Data protection
| Question | Response |
|---|---|
| Is data encrypted in transit? | Yes — TLS 1.2 or higher for all connections, with HTTP Strict Transport Security enabled. |
| Is data encrypted at rest? | Yes — AES-256 at rest across the managed database and storage layer. |
| Is there additional application-layer encryption? | Yes. Integration credentials, OAuth tokens, MFA secrets, and classified PII are encrypted at the application layer with AES-256-GCM using per-workspace subkeys derived via HKDF-SHA256, so one workspace's secrets cannot be decrypted with another's key material. Detail at /security. |
| Where is data stored, and are residency controls available? | Production data is processed in the United States. Data classification and residency controls are available in-product; specific residency requirements should be raised before contracting. |
| How is data backed up? | The managed database provides continuous backup with point-in-time recovery, and restore procedures are exercised on a recurring drill. Continuity detail is at /continuity. |
| What are the retention and deletion practices? | Customer data is retained for the life of the subscription and deleted on termination as set out in the DPA. Audit-log retention is configurable and supports multi-year (7+ year) horizons; legal hold suspends deletion where required. |
| Can customers export their data? | Yes — through the product, the documented API, and GDPR/CCPA export tooling, plus eDiscovery export for legal matters. See /docs. |
| How is tenant isolation enforced? | Every workspace-scoped table is queried with a workspace filter, and a continuous-integration linter fails the build when a query on such a table lacks one. Isolation is therefore enforced mechanically at build time, not only by code review. |
| Is there data-loss prevention and classification? | Yes — DLP controls, data classification of sensitive fields, and residency controls are available to workspace administrators. |
5. Security program
| Question | Response |
|---|---|
| Do you have a secure development lifecycle? | Yes. Changes are peer-reviewed before merge, run through an automated pipeline, and released continuously. Security-relevant design decisions are documented alongside the code they govern. |
| What is tested automatically in CI? | Type checking, unit tests, lint, SQL and tenant-scoping linters, and a migration job that applies every database migration twice to prove idempotency. A failure blocks the release. |
| How is change management handled? | All production changes go through peer review and CI. There is no direct-to-production path that bypasses review. |
| Is penetration testing performed? | Yes — annual third-party penetration testing. The summary report is available under NDA; request it from /trust. |
| Do you have a vulnerability disclosure process? | Yes. Coordinated disclosure to security@kavanah.ai; we acknowledge reports, work with the reporter through remediation, and do not pursue good-faith researchers. |
| How is personnel access to production controlled? | On a least-privilege basis: access is limited to personnel who need it for operations or support, and privileged actions are logged. |
| What is the incident response process? | Incidents are triaged, contained, and remediated, with affected customers notified without undue delay and within the timeframes set out in the DPA. Post-incident findings drive corrective work. |
| What monitoring is in place? | A platform health endpoint and a cron-health registry continuously verify that the application and every scheduled background job are functioning, alongside application error monitoring. |
| What is logged, and can logs be altered? | Security-relevant and administrative actions are written to an audit log made immutable by database triggers — records cannot be edited or deleted through the application. Retention is configurable and supports 7+ year horizons. |
6. Compliance & privacy
| Question | Response |
|---|---|
| What is your SOC 2 status? | SOC 2 Type II is in its observation period. We are not yet able to provide a completed report; it will be available under NDA once the audit concludes. Current status is maintained at /trust. |
| Are you ISO/IEC 27001 certified? | No. ISO/IEC 27001 certification is planned, targeting Q4 2027. We do not claim it today. |
| Do you support GDPR? | Yes. Data-subject access, export, and erasure requests are supported in-product, and our processing terms are in the DPA. |
| Do you support CCPA/CPRA? | Yes — the same in-product export and erasure tooling covers CCPA data-subject rights. Kavanah does not sell personal information. |
| Is a DPA available, and does it include SCCs? | Yes. The data processing addendum, including standard contractual clauses for international transfers, is at /dpa and is executed as part of the agreement. |
| Are sub-processors disclosed, with notice of changes? | Yes — the current list is published at /sub-processors, and change notification is governed by the DPA. |
| Is a HIPAA business associate agreement available? | Yes, on Enterprise. Raise it during contracting so the BAA is executed before any PHI is processed. |
| In what role do you act for customer data? | Kavanah acts as a data processor (service provider) processing customer data on the customer's instructions. The customer is the controller. |
| Do you sell personal information? | No. Kavanah does not sell personal information, and does not share it for cross-context behavioral advertising. |
7. Artificial intelligence
| Question | Response |
|---|---|
| Which AI providers do you use? | Anthropic Claude models, called through a governed tool-calling agent loop. AI providers are listed as sub-processors. |
| What customer data reaches the AI provider? | Only the workspace content needed to answer the request the user or automation made — the conversation and the records the agent reads or writes for that task. Full detail is at /ai-transparency. |
| Is customer data used to train models? | No. Customer data sent to the AI provider is not used to train models. |
| Can AI features be disabled? | Yes. AI features that run automatically or spend credits are opt-in and off by default; a workspace that does not enable them gets an unchanged product. Administrators control which capabilities are on. |
| How are agent actions governed? | A safe mode strips write tools from agent runs, and an action-policy engine parks risky actions for human approval before they execute. Agent identities (personas) carry capability scopes and member-level access control. |
| Are agent actions auditable? | Yes. An immutable action ledger records what the agent did, on whose behalf, and with what result — in addition to the standard audit log. See /ai-transparency. |
| Can agent actions be reversed? | Yes. An undo stack can reverse agent-performed actions, so a mistaken change does not require manual reconstruction. |
8. Availability & support
| Question | Response |
|---|---|
| Do you offer a service level agreement? | Yes. The availability commitment, severity definitions, response targets, and service-credit remedy are in the SLA; the terms that bind are those in the executed agreement. |
| What is the support model? | Email support at support@kavanah.ai on every edition, with response targets by severity for enterprise customers in the SLA. Onboarding and implementation support is described at /implementation. |
| How are incidents and maintenance communicated? | Affected customers are notified directly, with scheduled maintenance announced in advance and emergency security maintenance handled as an exception, per the SLA. |
| What are your business continuity and disaster recovery arrangements? | Continuous backup with point-in-time recovery and rehearsed restore procedures. Recovery objectives and the full continuity program are documented at /continuity. |
9. Commercial
| Question | Response |
|---|---|
| What is the pricing model? | Per active workspace seat, per month, plus AI credits for usage. List rates, the seat definition, and worked examples are on the Pricing Sheet. |
| What editions are available? | Starter (free), Basic, Pro, and Enterprise. Basic and Pro have no seat cap and differ by feature set, project and storage limits, and included AI credits; Enterprise is quoted per customer. |
| How is billing handled? | Monthly billing is self-serve by card through our payment provider. Annual billing and invoicing are arranged through sales. Terms are on the Pricing Sheet. |
| What are the contract terms? | Monthly self-serve subscriptions, or the term agreed in an executed order form. Editions can be changed or cancelled from the billing settings; on cancellation the workspace moves to the free edition and its data is retained. |
| Where do we get a quote or an order form? | Through /contact. Enterprise quotes can cover annual invoicing, purchase orders, negotiated SLA and DPA terms, a HIPAA BAA, security-review support, and custom onboarding. |
| Can you provide customer references? | References are arranged individually with customer consent. What we can and cannot share, and how to request one, is set out at /references. |
Need a questionnaire returned?
If your process requires a completed SIG, CAIQ, or your own questionnaire rather than this document, email security@kavanah.ai with the file and your deadline. Artifacts released under NDA are requested from /trust.
For pricing and contracting, see the Pricing Sheet and contact sales through /contact.
Questions from a security, privacy, or procurement team? Email security@kavanah.ai. For SOC 2, penetration-test, or questionnaire artifacts shared under NDA, use the request forms on the Trust & Compliance page.