Security
Security and data sovereignty
Kyvernon runs without a connection to the vendor, stores data in open formats and is developed and supported from the European Union.
Development and support
Kyvernon is developed by GoTrust BV in Belgium. Development, build infrastructure and support are located in the European Union. Support contracts are governed by Belgian law. The web UI is available in English, Dutch and French.
Air-gapped operation
- No telemetry or usage reporting
- Licence files that activate offline, without an online licence check Planned
- Installation and upgrades from signed offline depots
- Documentation included with the product
Data formats
| Data | Format |
|---|---|
| Virtual disks | qcow2, export to VMDK and raw |
| Virtual machines | OVF and OVA |
| Configuration and inventory | JSON through the native API |
| Audit log | JSON, CEF, syslog |
| Metrics and traces | Prometheus, OpenTelemetry |
| API definitions | OpenAPI 3.1, protobuf |
Hypervisor
Kyvernon VMM is developed by GoTrust in Rust. It contains no device-model code from third-party virtual machine monitors. See platform architecture.
Security defaults
- TLS 1.3 on all endpoints, including traffic between hosts and controllers
- No default passwords; local accounts are limited to break-glass use and raise an alert
- Multi-factor authentication for administrators, including WebAuthn hardware keys
- Role-based access control with inheritance along the inventory tree
- Append-only audit log for every change
- Signed, immutable host images
- Planned: measured boot with host attestation, per-VM encryption with KMIP, confidential virtual machines
Release integrity
- Ed25519 signatures on every release; public keys are published in the documentation
- Software bill of materials in CycloneDX format
- Dependency licence and vulnerability checks before every release
- Coordinated vulnerability disclosure, aligned with the EU Cyber Resilience Act
Third-party software
Kyvernon is closed-source software. Its dependencies are limited to permissive licences; the product contains no GPL or LGPL code. The software bill of materials and the licence notices of all third-party components ship with every release and are available in the product documentation. Provenance of generated code is recorded per file.
Compliance evidence
Kyvernon exports configuration profiles with drift detection, audit logs, backup confirmations and restore test results. With monsys.ai this data is included in audit packs for NIS2, the Cyber Resilience Act and ISO 27001.
Certifications
Kyvernon holds no certifications at this stage. Certifications are listed here once obtained.