Security

Kvali is built for payment providers' risk teams, so it is built to be audited. The full security pack is available to clients and prospects on request.

No card data

Kvali works with merchant websites, documents and decisions. Card numbers are refused wherever text enters the product, so Kvali is outside PCI DSS scope.

EU hosting, encrypted

Database and application in Frankfurt; email in Ireland. Encrypted in transit and at rest.

Each client sees only its own data

Enforced by the database itself (row-level security) and proven by automated tests on every change.

Records that can't be changed

Audit logs, evidence, findings and decisions are append-only: the database refuses edits, Kvali's own servers included.

Staff access is logged

Kvali staff reach client data only through an operator console with two-factor authentication; every access is written to an append-only log.

AI that quotes, people who decide

Every finding quotes the merchant's own page or it is dropped; outcomes are decided by the client's team; a decline is never automatic.

Polite, honest crawling

Public pages only, no forms or accounts, robots.txt respected, and the crawler identifies itself with signed requests (see /bot).

Subprocessors: see the list.