narada kavach

Your data wears armor.

Kavach — Sanskrit for armor — is the security system around Narada, built as seriously as the product itself. Six layers, from the way our code is written to adversarial audits that re-attack the running system. Each layer catches what the one before it missed.

And one rule above all of them: nothing on this page is a marketing line. Every statement maps to a control we can point at — and we tell you what we don't claim.

The architecture

Six layers between the world and your rows.

The claims

Every claim, its mechanism — and its limits.

One company, one vault.

A query without your company's context returns zero rows — never someone else's data. Isolation is enforced by the database itself, on every table, on every query.

We do not claim physically separate databases or per-client encryption keys.

Coverage is automatic.

Every table holding client data is protected by derivation from the database schema — not a hand-kept list someone can forget to update. Re-verified every time the system starts.

Three internal ops-telemetry tables are cross-company by design; they never appear on client routes.

Every request carries your key.

API access requires your per-tenant key, stored hashed. Anything public is an explicit, reviewed allowlist.

We do not claim SSO — it is on the roadmap, and we say so.

No secrets in the code.

Credentials live in environment variables only. A secret scan runs at every commit and every build.

Your people stay out of our logs.

No customer personal data in application logs — a standing rule with a recurring audit behind it.

We do not claim logs are empty — aggregate counts and internal ids appear.

The AI cannot invent a number.

Every figure the AI speaks must trace to a verified computation over your rows. A money figure it cannot cite is removed from the answer rather than shown.

The AI never acts alone.

Every AI write action is two-phase: Narada proposes, you approve. Confirmed actions are idempotent and audited.

We do not claim autonomous writes — the Autopilot tier is explicitly 'coming soon'.

Hard ceilings everywhere.

Requests are rate-limited, AI reasoning loops are iteration-capped, AI spend has a per-company budget, and billing webhooks are cryptographically signature-verified.

Card data never touches us — our payment processor is the processor of record.

The AI boundary

What the AI can and cannot see.

The AI sees

Numbers computed by verified code from your rows only — the AI narrates results, it never queries freely
Your questions, and its own past answers inside your workspace
Documents you explicitly hand it — a price-list photo, a purchase order

The AI never sees

Other companies' rows — its tools read through the same database-level isolation as everything else
Your ERP credentials or API keys — encrypted at rest, never placed in a prompt
Instructions hidden in your data — everything from your data enters fenced as data, never as commands

One honest footnote: those fenced, minimal tool results are processed by our AI provider (Anthropic) to write the words you read. That is the entire surface — and it's stated here, not buried in a policy.

Self-surveillance

Kavach watches itself.

live security posture — recomputed from the running system

Client isolation coverage every client-data table enforced
Database role data served by a role that cannot bypass isolation
Authentication on by default, per-tenant keys
Rate limits active on every abusable endpoint
AI guardrails money guard, data fencing, loop caps
Billing webhooks signature-verified

The run-time layer reports its own state: an operations panel recomputes these checks from the live system, so a control that regresses turns red instead of silently rotting. Armor that can't report its own dents isn't armor.

For your IT and finance gatekeepers.

The legal side — data-processing terms, encryption, deletion, export — lives on one page, written to be forwarded.

Security & data-processing terms Open the live demo