Security
Security built around your schemas.
Kozo is designed for a simple promise: designing your database should never make your data harder to protect. These controls describe the public posture of the product today.
Last updated · October 23, 2026
Transport
TLS
Encrypted traffic in production
Storage
RLS
Account-scoped database access
Training
No
Your content is never used to train models
Controls
What protects your data
The controls below cover the public site, the signed-in app, the database and the AI providers that generate your schemas.
Privacy by default
Prompts, imported DDL and generated schemas are scoped to your account. Kozo never sells them or uses them to train models.
Encrypted transport and storage
Production traffic is served over TLS, and your schemas are encrypted at rest in the database.
Scoped data access
Supabase row level security keeps every schema, version and setting tied to the account that owns it.
Key separation
Public browser keys, server-only service keys and AI provider keys are kept apart in environment configuration and never reach the browser.
Input validation
API routes validate request bodies before they reach generation, storage or email code.
Account control
Export your data as JSON, change your settings or delete your account and everything in it from settings.
Development
Secure development practices
Security is enforced in the implementation path rather than handled as a separate checklist at the end.
- Validate every public API input before business logic runs.
- Keep authentication and authorization checks at route boundaries.
- Avoid logging prompts, generated schemas or provider secrets.
- Keep a seeded demo mode so the product can be explored without real data.
- Run type, lint, test and build checks before production changes ship.
Customers
How to help keep your account secure
Accounts
Protect credentials
Use a strong, unique password, avoid shared accounts and tell us at once if you suspect someone else has access.
Schemas
Review before you ship
Read generated tables, keys, indexes and migrations, and check the health findings, before you run them against production data.
Disclosure
Report issues quickly
Send security findings through the vulnerability disclosure policy.