Security starts on your own computer.

Your tenant history stays on your computer.

Kairavo runs its own PostgreSQL database on your computer. It listens only on 127.0.0.1, so other computers cannot reach it, and it accepts only SCRAM password logins. Kairavo creates random database passwords and keeps them in its encrypted store. Each installation keeps its own history; two admins on two computers have two separate histories.

Kairavo does not encrypt the database files itself. Turn on disk encryption, such as BitLocker on Windows or FileVault on macOS, to protect your history at rest.

Secrets are encrypted by the operating system.

Tenant sign-ins, Microsoft token caches, your license key, database passwords and integration secrets such as webhook URLs are encrypted with the operating system’s secure storage: DPAPI on Windows and the Keychain on macOS. They are bound to your user account on that computer. On Windows, DPAPI protects them against other users of the computer, not against other programs that run as your own user.

Logs stay on your computer and are scrubbed of tokens, keys and credentials.

Your app registration, your consent.

Kairavo has no vendor app in your tenant. You create a single-tenant app registration in your own Entra tenant and grant admin consent for the delegated, read-only Microsoft Graph permissions listed in the setup guide. Kairavo signs in through it with the authorization code flow and PKCE in your default browser. It never uses a client secret or a certificate, and you can remove the app registration at any time.

Monitoring only reads your tenant: collection refuses every request that is not a read. Automations are the only exception. Scripts that change your tenant or send email stay blocked until you turn on Allow automations that change your tenant, every such run asks for your confirmation in a system dialog, and it signs in with exactly the permissions the script declares. Those write permissions are ones you add to your own app registration.

What leaves your computer.

Kairavo has no telemetry, no crash reporting, no analytics and no diagnostic upload. Besides Microsoft sign-in and Microsoft Graph, it connects only to these services:

• Kairavo licensing on kairavo.com: the license key, a random installation ID, the tenant ID, the operating system and the app version, plus your app registration’s client ID and a fresh Microsoft sign-in token to find licenses shared with your tenant. Never device, user, policy or app data, logs or Microsoft Graph access tokens.
• GitHub for update checks and downloads: a plain HTTPS request with no tenant or product data.
• PowerShell Gallery, only when you choose to install the Microsoft Graph authentication module for automations.
• Services you configure, such as alert and report channels in Teams, Slack, email or a webhook. They are off until you set them up and receive only what they need, sent directly from your computer, never through Kairavo.

Diagnostic data reaches us only when you attach an export to a support email yourself. The export is saved to a file you choose, so you can read it first. See Privacy and data boundary in the docs and the Privacy Policy.

Signed releases and checked updates.

Release installers are code signed: on Windows with Azure Artifact Signing, on macOS with an Apple Developer ID, and notarized by Apple. Kairavo updates itself from the public releases feed on GitHub, installs only stable releases and never moves to an older version.

On Windows, Kairavo checks the digital signature of a downloaded update again right before the setup program runs. If the check fails or does not finish within 30 seconds, the update is not installed and your current version keeps running. You can turn automatic updates off, or disable them with a policy and deploy approved versions through Intune; see Updates in the docs.

Report a vulnerability.

If you find a security issue in Kairavo or on kairavo.com, write to security@ugurlabs.com with the affected version and the steps to reproduce it. Please give us time to fix it before you publish details.

This page describes how Kairavo is built. It is not a certification or the result of an independent audit.