Security and privacy

Your Discord login is the key to your Kovex data. Hardening it is the single highest value security step you can take.

• Enable two-factor authentication on Discord.
• Use a password that is unique to Discord.
• Review the applications and devices authorised on that account periodically.

A connected machine can launch your accounts and receive the credentials needed to do it. Only link computers you control.

Kovex is built so that sensitive values are unreadable at rest and only leave the server when a job you asked for needs them.

• Passwords, authenticator secrets, and proxy credentials are encrypted before storage.
• Secret fields stay masked in the interface until you reveal them.
• Credentials are released for agent jobs on your own machines, and for reveal or export requests you make yourself while signed in.

1. 1Read the listCheck the names and last seen times against machines you actually use.
2. 2Revoke anything unfamiliarRemove the entry, then change your Discord password if you cannot explain it.

Every agent download is published with a SHA-256 value. Comparing it proves you installed the file Kovex published.

Public pages describe what is collected and how to reach the right team.

• The privacy policy explains what data Kovex holds and why.
• The security page explains how to report a vulnerability responsibly.
• Privacy and legal requests go to the address published on those pages.