Security

Sevalla runs your applications and databases on Kubernetes clusters in Google Cloud and Oracle Cloud Infrastructure (OCI), and serves all web traffic through Cloudflare’s network. Sevalla is operated by Kinsta Inc., whose security program is audited for SOC 2 Type II and certified to ISO/IEC 27001:2022, with Sevalla in scope.

Compliance

Standard	Status
SOC 2 Type II	Independent audit of how well the security controls worked over a period of time. Report available on request.
ISO/IEC 27001:2022	Certified (information security management)
ISO/IEC 27017	Certified (security controls for cloud services)
ISO/IEC 27018	Certified (protection of personal data in the cloud)
CSA STAR Level 1	Self-assessment published as a CAIQ v4.1.0 questionnaire
GDPR	Compliant. The Data Processing Addendum is part of your agreement.
CCPA	Compliant

Sevalla’s application hosting, database hosting and static site hosting, and the system architecture under them, are in scope for SOC 2, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018 and CSA STAR.

Get the SOC 2 report and other documents

The Kinsta Trust Center holds every report and certificate. The ISO certificates are public: click View next to one. The SOC 2 Type II report, the 2026 penetration test report, the CSA STAR Level 1 CAIQ and the HECVAT Full need a request.

Open the documents

Go to trust.kinsta.com/resources and click Request access next to the document you need.

Fill in the form

Enter your first name, last name, email, company name and the reason. Under Access level, keep Full access for every document, or pick Limited access and choose the documents.

Send the request

Click Request access.

The Kinsta team reviews requests within one business day and emails you access. If you haven’t heard back after one business day, email sales@kinsta.com.

How Sevalla protects the platform

Area	What Sevalla does
DDoS protection	All HTTP and HTTPS traffic to applications and static sites passes through Cloudflare, which mitigates attacks at layers 3, 4 and 7. See DDoS protection.
Encryption in transit	Applications and static sites are served over HTTPS, with SSL certificates for your Sevalla and custom domains. Requests over plain HTTP are redirected to HTTPS. See Custom domains.
Encryption at rest	Datastores that hold sensitive customer data are encrypted at rest.
Isolation	Each application and each database runs in its own Kubernetes namespace. Traffic between namespaces is denied unless you add an internal connection. See Infrastructure.
Staff access	Access to production systems, databases, networks and encryption keys is limited to authorized staff with a business need, each with unique credentials, and is revoked when they leave.
Testing	A penetration test runs at least once a year, and the vulnerabilities it finds are fixed under a remediation plan. Controls are also self-assessed at least once a year.
Continuity	Business continuity and disaster recovery plans are tested at least once a year.
People	Employees pass background checks and sign confidentiality agreements.

Security controls you manage

Control	Where	Details
Two-factor authentication	My account	A code from an authenticator app, or by email, when you sign in. See Sign-in and two-factor authentication.
Single sign-on (SAML)	Single sign-on	Sign in through your identity provider, optionally mandatory for everyone in the company. See Single sign-on.
Roles	User management, a project’s Access management tab	Give each person access to the company, a project or single services, with the least access they need. See Users and roles.
API keys	Tools > API keys	Keys with only the permissions a script or agent needs. Rotate or disable them when they’re no longer needed. See API keys.
IP restrictions	An application’s or database’s Networking tab	Allow or deny traffic from specific IP addresses and ranges. See IP restrictions and Restrict access by IP address.
Private networking	An application’s Networking tab	Connect applications and databases over internal connections instead of public endpoints. See Internal connections.

For the full split of duties, see Shared responsibility.

Subprocessors

These subprocessors handle data for Sevalla. The Trust Center subprocessor list is always current.

Subprocessor	Purpose	Location
Cloudflare	Security and performance	Regional
Google Cloud Platform	Hosting and security	The location you choose
Oracle America, Inc. (OCI)	Hosting and security	The location you choose
ClickHouse, Inc.	Analytics and log storage	United States
Intercom	Customer support and communication	United States
HubSpot	Customer support and communication	United States
Anthropic	AI-powered tooling and analytics	United States and Ireland
OpenAI	AI-powered tooling and analytics	United States and Ireland

Security policies

Shared responsibility

What Sevalla secures and what you secure.

DDoS protection

Cloudflare’s always-on protection and what it covers.

Report a vulnerability

How to report a security issue privately.

Acceptable use

Prohibited content and activity, sanctions and .ru domains.

Get started

AI agents

Applications

Pipelines

Databases

Static sites

Object storage

Load balancers

Domains

Git providers

Projects

Developer tools

Company

Billing

Account

Platform

Security and compliance

Support

Compliance

Get the SOC 2 report and other documents

How Sevalla protects the platform

Security controls you manage

Subprocessors

Security policies

Shared responsibility

DDoS protection

Report a vulnerability

Acceptable use

​Compliance

​Get the SOC 2 report and other documents

​How Sevalla protects the platform

​Security controls you manage

​Subprocessors

​Security policies

Shared responsibility

DDoS protection

Report a vulnerability

Acceptable use

Compliance

Get the SOC 2 report and other documents

How Sevalla protects the platform

Security controls you manage

Subprocessors

Security policies