Security practices built into the Kelvaro application

Browser and application-layer protections

• Content Security Policy is configured for the production application.
• X-Frame-Options is set to deny framing, and X-Content-Type-Options is set to nosniff.
• Referrer and Permissions Policy headers are configured at the application layer.
• Authentication is integrated through Clerk in the application.
• Error monitoring is integrated through Sentry in the production application configuration.

Sensitive token-bearing routes

The application applies additional protections to onboarding and invite routes that may contain bearer-style tokens. Current configuration uses private/no-store caching, no-referrer behavior, and noindex/nofollow/noarchive directives for those sensitive paths.

Security claim boundary

This page does not state that Kelvaro has completed SOC 2, ISO 27001, PCI DSS, or another third-party certification unless a separate current statement explicitly documents that status.

Security controls evolve with the product. The reviewed date on this page indicates when the public description was last checked against the application configuration.

Related resources