Tenant isolation
Every workspace is its own tenant. Access rules are enforced on the server for every request, so one customer’s data can’t be read from another’s workspace — and an agency’s client workspaces are isolated from each other.
Security
Your brand’s data, kept carefully.
Kedova is built by Korevra in Lagos for the Nigeria Data Protection Act 2023 and the GAID 2025. Here is how we protect your workspace, the accounts you connect and your audience’s data.
Controls
What protects your workspace.
Encrypted account tokens
Tokens for the accounts you connect are sealed with AES-256-GCM under a key derived for your workspace alone. A token copied elsewhere can’t be decrypted. No adapter ever holds two workspaces’ tokens.
Roles and an audit log
Owners, admins and members have different rights. Sensitive actions — connecting a channel, changing a publishing mode, importing contacts — are recorded in an audit log.
Consent ledger
Email subscribers join by double opt-in and Kedova keeps the proof: when, from which page, the exact consent wording and a hashed IP. Imported contacts need a stated consent source.
Export and deletion
Export your workspace data whenever you like. Delete your account and your personal data goes with it, apart from records the law requires us to keep, such as invoices.
Hosting
Kedova runs on Google Cloud and Firebase in the europe-west1 region. Data is encrypted in transit with TLS and at rest by Google Cloud. Enterprise can choose in-country residency or a private cloud.
NDPA 2023 · GAID 2025
Data protection, designed in.
For your account, Korevra is the data controller. For the audience data in your workspace — your contacts, subscribers and the people who message you — you are the controller and Korevra is your processor, under our data processing agreement.
- Consent-based messaging. WhatsApp and email go only to people who opted in, and every marketing email carries an unsubscribe link.
- No personal data in creatives. The compliance gate keeps people’s personal data out of what you publish.
- Rights honoured. Access, correction, deletion, objection and portability requests are handled through the app or by email.
- Transfers safeguarded. Processing outside Nigeria relies on the safeguards the NDPA recognises, such as contractual clauses with our providers.
AI and your content
Kedova sends the minimum content needed to its AI providers to draft, check and illustrate your marketing — Anthropic for writing and reasoning, Google Vertex AI for images and embeddings — through their business APIs. Under their commercial terms, they do not use that content to train their models.
Kedova makes no decisions about people that have legal or similarly significant effects. You review what it drafts, and you decide what is published.
Sub-processors
Who helps us run Kedova.
We will update this list before we add or replace a sub-processor that handles customer personal data.
| Provider | What it does for Kedova | Where |
|---|---|---|
| Google Cloud and Firebase | Hosting, database, file storage, authentication and server functions | europe-west1 (Belgium) |
| Anthropic | AI models for planning, writing and checking content | United States |
| Google Vertex AI | AI image generation and text embeddings for the knowledge base | Google Cloud |
| Flutterwave | Payment processing | Nigeria |
| Paystack | Payment processing | Nigeria |
| Meta (WhatsApp Cloud API) | Notifications and approvals over WhatsApp | Meta data centres |
Report a vulnerability. Email hello@korevra.com with “Security report” in the subject, the steps to reproduce and any proof of concept. Please don’t access other customers’ data or disrupt the service while testing. We will acknowledge your report and keep you updated.
Your brand, announced. Starting this week.
Give Kedova your website. It drafts your brand kit, plans your first week and has posts waiting for your approval. You stay in charge of every word.