Security
How your data is protected, what we store, and what we would tell you if something went wrong. Also the single most effective protection available to you, which costs nothing and has nothing to do with us.
Technical controls
- Encryption in transit. All traffic between your device and our systems uses TLS with 256-bit encryption.
- Encryption at rest. Stored personal data, including identifiers used for bureau reporting, is encrypted.
- Access control. Internal access to member data is role-based, logged, and limited to staff who need it for a specific task.
- Independent audit. Our controls are assessed under SOC 2 Type II, which tests whether controls operated effectively over a period rather than at a single moment.
What we store, and why
| Data | Why we hold it |
|---|---|
| Name, date of birth, address | Required to furnish an account to the credit bureaus |
| SSN or ITIN | Required for bureau identification and matching |
| Bank account details | To collect autopay; held with our payment processor |
| Payment history | The record we furnish monthly to the four bureaus |
| Contact details | Verification at signup and alerts about your account |
We do not sell member data to advertisers or data brokers. Data is shared with the credit bureaus because that is the entire function of the product, and with processors who are contractually bound to use it only for the service they provide. Full detail is in the privacy policy.
The protection that matters most is free
A credit freeze is free by law and more protective than anything we sell. It blocks new creditors from pulling your file, which is how most new-account fraud is stopped. It does not affect your credit score and does not close existing accounts.
You request a freeze directly from each bureau. Most people freeze the big three and stop — leaving the fourth file open. Our Innovis page explains why that matters and how to close it.
What the bundled protection does and does not do
Every plan includes up to $1M of ID-fraud cover, dark-web monitoring and resolution support. That is genuinely useful, and it is not a substitute for a freeze.
Monitoring shortens the time between an event and your knowing about it. It does not prevent the event. The $1M figure is a ceiling on covered recovery costs, not a sum paid on a claim. Full terms are on the product page.
If something goes wrong
We would tell you. Where a breach affects your personal data, this is what happens.
- Affected members are notified directly by email and in-app, not by press release.
- We say what happened. The notice will state what data was involved, when we became aware, and what we have done, rather than describing an “incident affecting a limited number of accounts”.
- Regulators are notified in line with the breach-notification law of each affected member’s state and any applicable federal requirement. Notification deadlines differ by state and we work to the shortest one that applies.
- We do not require a release in exchange for identity protection offered after an incident.
If you believe your Kovo account has been accessed without your authorisation, contact [email protected] immediately rather than waiting for us to notice.
What you can do
- Freeze your file at all four bureaus. Free, and the highest-value action available.
- Opt out of prescreened offers at optoutprescreen.com — one request covers all four bureaus.
- Use a unique password here and enable any additional authentication we offer.
- Check your reports annually. You are entitled to a free report from each bureau every 12 months.
Reporting a vulnerability
Report it to [email protected]. We acknowledge within two business days and will tell you when it is fixed.
We will not pursue legal action against researchers acting in good faith who stay within their own test account and give us reasonable time to fix an issue before disclosing it.