Security

Last updated: October 11, 2026

Cova connects to your monitoring tools to help your team respond to incidents. This page explains how we protect your data and your systems. For questions or a security review, email security@getcova.ai.

Infrastructure

Cova's application runs on Render and its database on Neon (PostgreSQL), both in the United States. The full list of sub-processors, what each one processes and where, is in our Data Processing Agreement.

Encryption

• In transit: every connection to Cova uses HTTPS.
• At rest: the database is encrypted at rest.
• Your credentials: the API tokens and AI keys you connect are encrypted again by Cova, with a key stored separately from the database. They're never shown back in full.

Workspace isolation

Each workspace's data is kept separate. Every request is tied to the signed-in person's workspace on the server, so one workspace can't read or change another's data.

Access to your tools

• Cova reads from your connected tools. It changes something only after a person approves it, or within the limits your admins set for each kind of change and each environment.
• Cova never pages anyone.
• Webhooks from GitHub and GitLab are verified before Cova acts on them.

AI

AI features use the provider key you add (Anthropic, OpenAI or Google). Requests go through your own account, under your agreement with that provider. Cova doesn't train AI models on your data.

Sign-in and permissions

• You sign in with Google or GitHub. Cova doesn't store passwords.
• Sessions use secure, HTTP-only cookies.
• Every workspace has three roles (admin, editor and viewer), checked on the server for every action.
• API keys are stored hashed and shown only once, when they're created.

Cova staff access

Cova's staff tools show workspace-level information only: its name, members, which tools are connected and how many incidents are open. They never show incident details, telemetry or credentials. Any change staff make to a workspace is recorded in that workspace's audit log.

Audit log

Every action in a workspace, by a person or by Cova, is recorded with who did it, what and when. Entries can't be edited or deleted. Members see the log in Settings and can export it as CSV.

Data retention and deletion

• Disconnecting a tool deletes its stored credentials.
• A deleted workspace can be restored for 30 days. After that, its data is permanently deleted.

Security incidents

If a security incident affects your data, we'll notify you within 72 hours of becoming aware of it, as set out in our DPA.

Reporting a vulnerability

If you believe you've found a security issue in Cova, email security@getcova.ai with the details. Please don't test against other customers' workspaces or data.