Security
Koshra drafts; a person decides. This page sets out the approval policy, how Koshra is hosted, where data lives, the licence and how data is handled.
Assisted preview
A server-hosted workspace, set up with you. Run a server-hosted Koshra deployment with assisted setup. Hosting, support and model-provider terms are agreed separately.
- Cloud. Koshra Cloud is the server-hosted web app, in assisted preview.
- Mac. Koshra for Mac is coming soon: an unsigned local prototype, not a released app. Optional linking between Cloud and Mac is not available yet.
- Computers. Bots currently use shared cloud computers. Dedicated per-bot computers and fully validated live viewing are coming soon.
- Your data. Core application data is stored on the selected server. Files, connected services and model providers may process data elsewhere.
- Foundation licence. Built on an Apache-2.0-licensed foundation. Koshra-specific distribution, support and resale rights are governed by separate agreed terms.
- Models. Choose supported model providers or bring an API key. Provider charges, quotas, availability and data policies apply. Some providers offer free-tier models; availability is not guaranteed.
- Sign-in. Google and generic OIDC sign-in are coming soon: the implementation exists, but production credentials and end-to-end sign-in are not configured or validated. Using an existing ChatGPT or Claude subscription is also coming soon.
- Plays. Plays is a preview catalog. Supported actions are limited to owner-staged email and Twenty company creation, with a separate explicit approval.
- Isolation. Cloud computer isolation has passed bounded synthetic checks. Full supervisor restart and reconnection acceptance is unfinished. Mac OS-enforced sandboxing is coming soon.
Review each configured provider before choosing a residency policy. No security certification, contractual uptime or overall product ranking is claimed.
Licence, data residency and support
Can an agency resell or white-label Koshra?
Only under separate agreed terms. The Apache-2.0 licence covers the foundation, not every Koshra release asset or commercial right.
Where is my data stored?
Core application data is stored on the selected server. Files, connected services and model providers may process data elsewhere. Review each configured provider before choosing a residency policy. Koshra does not claim a formal residency certification.
Is self-hosting supported?
Assisted self-hosting is available by arrangement. Production changes should have a reviewed backup and rollback plan. That is not a contractual promise that every change already has one.
What licence is the foundation under?
Apache-2.0 for the foundation. It allows commercial use of that foundation under its own terms. Koshra-specific distribution, support and resale rights are governed by separate agreed terms.
Does Koshra hold SOC 2 or ISO 27001?
No. No security certification is claimed. Content encryption and an encrypted credential store are configured. Tenant-aware authorization and database isolation controls exist. Comprehensive security acceptance remains unfinished.
Approval policy
Review drafts before use. The limited Plays email action requires explicit owner approval. Ordinary connector actions follow configured tool rules. End-to-end coverage across all outbound paths is not yet verified.
- Configured CRM rules block destructive operations and require review for bulk changes.
- Plays currently supports only typed Twenty company creation. HubSpot and arbitrary CRM play writes are not supported.
- Content encryption and an encrypted credential store are configured. No security certification is claimed.
- Full supervisor restart and reconnection acceptance is unfinished. Mac OS-enforced sandboxing is coming soon.
Self-hosting
Assisted self-hosting is available by arrangement. A deployment can include a web app, API, worker, supervisor and database. Google and OIDC production credentials are not configured. Content encryption and an encrypted credential store are configured.
Data handling
- Core application data is stored on the selected server. Files, connected services and model providers may process data elsewhere.
- Provider keys you add are stored encrypted and shown masked, where that store is configured.
- Demo requests are stored on our server for follow-up about Koshra. This page does not promise that they are never shared.
Operations
Production changes should have a reviewed backup and rollback plan. Public status reports observed service health. No contractual uptime guarantee is published.
Certifications Not yet
Koshra does not hold a third-party security certification today. If you need a security review, talk to us.
Also as Markdown for AI agents.
Last updated