Security and trust
Built for security teams to say yes.
Piquant is security software, so it is held to the rules it enforces. These are the principles it is built on, and what it does not do.
Principles
What Piquant will not compromise on
Every call through one gate
No call reaches a company tool without passing identity, policy, approval and credential checks, in that order, and being recorded first.
Identity from the system
People are identified by their operating-system sign-in and their Entra account. What a program says about itself never grants anything.
Policy follows the person
Rules come from a person's Entra roles, not from the machine they sit at. Unknown cases are denied or need approval.
Approvals that cannot be reused
An approval covers one exact call, once, and expires. Any change to the call, the person, the tool or the policy makes it void.
Keys out of reach
Credentials never appear in AI-tool settings, logs, records or prompts. They are added at the moment an allowed call runs.
Untrusted by default
Every MCP server, tool description and tool output is treated as untrusted. Nothing a tool returns can change policy.
Your data
It stays with you
- The control plane runs on your own server, in your network.
- There is no mandatory telemetry: nothing is sent to Koavyn.
- Records hold who called which tool and the decision, never the content of the call.
- Administration needs a company sign-in; there is no unauthenticated management interface.
- Piquant only claims to govern what it brokers. Tools it merely discovers on a machine are shown as such, not as governed.
How it is built and checked
Engineering habits
- Written in Rust, a memory-safe language, using the official MCP software development kit.
- Every change passes the full test suite, including the parts that face untrusted input.
- Dependencies are checked against published security advisories on every change and weekly, and every build uses locked versions.
- Security reviews have been run against the product, and their findings fixed in the releases that followed.
Piquant is in pilot use. It has no certifications yet, and we do not claim any.
Responsible disclosure
Found a vulnerability?
Please write to loukasmousas@koavyn.com with the details and how to reproduce it. We will confirm receipt, keep you informed, and credit you if you wish. Please give us reasonable time to fix it before making it public.
Start with one team.
A pilot begins in provide mode: people keep their AI tools, and Piquant adds the governed connections. Locking, approvals and shared company tools follow when the team is ready.