# Security

> What Koshra configures today, and what is still unfinished: encryption, tenant controls, approvals, hosting and the absence of a security certification.

Canonical: https://koshra.si/security
Last updated: 2026-11-07

## Assisted preview

A server-hosted workspace, set up with you. Run a server-hosted Koshra deployment with assisted setup. Hosting, support and model-provider terms are agreed separately.

- Cloud: Koshra Cloud is the server-hosted web app, in assisted preview.
- Mac: Koshra for Mac is coming soon: an unsigned local prototype, not a released app. Optional linking between Cloud and Mac is not available yet.
- Computers: Bots currently use shared cloud computers. Dedicated per-bot computers and fully validated live viewing are coming soon.
- Your data: Core application data is stored on the selected server. Files, connected services and model providers may process data elsewhere.
- Foundation licence: Built on an Apache-2.0-licensed foundation. Koshra-specific distribution, support and resale rights are governed by separate agreed terms.
- Models: Choose supported model providers or bring an API key. Provider charges, quotas, availability and data policies apply. Some providers offer free-tier models; availability is not guaranteed.
- Sign-in: Google and generic OIDC sign-in are coming soon: the implementation exists, but production credentials and end-to-end sign-in are not configured or validated. Using an existing ChatGPT or Claude subscription is also coming soon.
- Plays: Plays is a preview catalog. Supported actions are limited to owner-staged email and Twenty company creation, with a separate explicit approval.
- Isolation: Cloud computer isolation has passed bounded synthetic checks. Full supervisor restart and reconnection acceptance is unfinished. Mac OS-enforced sandboxing is coming soon.

Review each configured provider before choosing a residency policy. No security certification, contractual uptime or overall product ranking is claimed.

## Licence, data residency and support

### Can an agency resell or white-label Koshra?

Only under separate agreed terms. The Apache-2.0 licence covers the foundation, not every Koshra release asset or commercial right.

### Where is my data stored?

Core application data is stored on the selected server. Files, connected services and model providers may process data elsewhere. Review each configured provider before choosing a residency policy. Koshra does not claim a formal residency certification.

### Is self-hosting supported?

Assisted self-hosting is available by arrangement. Production changes should have a reviewed backup and rollback plan. That is not a contractual promise that every change already has one.

### What licence is the foundation under?

Apache-2.0 for the foundation. It allows commercial use of that foundation under its own terms. Koshra-specific distribution, support and resale rights are governed by separate agreed terms.

### Does Koshra hold SOC 2 or ISO 27001?

No. No security certification is claimed. Content encryption and an encrypted credential store are configured. Tenant-aware authorization and database isolation controls exist. Comprehensive security acceptance remains unfinished.

## Approval policy

Review drafts before use. The limited Plays email action requires explicit owner approval. Ordinary connector actions follow configured tool rules. End-to-end coverage across all outbound paths is not yet verified.

- Configured CRM rules block destructive operations and require review for bulk changes.
- Plays currently supports only typed Twenty company creation. HubSpot and arbitrary CRM play writes are not supported.
- Creating a bot or a schedule can require approval where that rule is configured.
- Content encryption and an encrypted credential store are configured. Comprehensive security acceptance remains unfinished.

## Hosting

Assisted self-hosting is available by arrangement. A deployment can include a web app, API, worker, supervisor and database. Protected routes refuse requests without a signed-in session where that check is configured. Google and OIDC production credentials are not configured.

## Data handling

- Core application data is stored on the selected server.
- Files, connected services and model providers may process data elsewhere.
- Demo requests on this site are stored on our server for follow-up about Koshra. This page does not promise a retention period or that data is never shared.
- Security-event logging and a default 90-day event pruner are implemented. Immutable off-host audit export, general retention and offsite disaster-recovery validation are coming soon.

## Operations

Production changes should have a reviewed backup and rollback plan. Public status reports observed service health. No contractual uptime or high-availability guarantee is published.

## Certifications

No security certification is claimed. If you need a security review, talk to us: https://cal.lumenlab.tech/rasul/30min