Security & trust
Our cameras watch shelves. Your data answers to you.
Vending data security starts at the device. A Kava Cooler recognizes products on board and never stores or sends images of faces. Everything that does leave the device is encrypted in transit and at rest, and only the roles you choose can see it.
- images of faces stored or sent
- 0images of faces stored or sent
- encryption at rest
- AES-256encryption at rest
- encryption in transit
- TLS 1.2+encryption in transit
Recognition happens inside the cooler, and stays there.
Kava Vision runs on an on-device neural processor. Four edge cameras (six on the C2-XL) and per-shelf load cells decide what left the shelf, and the result leaves the cooler as a line item, not a picture. There is no facial recognition, and no images of faces are stored or sent. Shopper Analytics works from anonymous aggregates only.
That design choice also makes checkout faster and steadier. Because recognition doesn't depend on the network, the door opens in under a second after a tap and the receipt is final within 10 seconds of the door closing, even on a weak connection.
- Cameras are aimed at shelves and products, not at the person in front of the door.
- Results leave the device as line items: product, quantity and price.
- Restock events are recognized and reconciled, so staff aren't flagged as shoplifters.
What we collect, and what we don't
| Data | Collected? | Why |
|---|---|---|
| Images of faces | Never stored or sent, by design | |
| Product movement on shelves | Yes, processed on the device | To charge the right item and reconcile restocks |
| Transaction records | Receipts, refunds, reporting and forecasting | |
| Card numbers | Encrypted at the reader with P2PE-capable readers | Decrypted only by the certified processor |
| Temperature and door events | Food-safety logs, alerts and maintenance | |
| Traffic and dwell | Anonymous aggregates only | Placement and planogram decisions |
| Shopper identity | Only for badge, app or payroll-deduct programs | To apply employer subsidies and limits |
Security specifications
Data protection
- Encryption in transit
- TLS 1.2+
- Encryption at rest
- AES-256
- Hosting
- US regions
- Custom data residency
- Enterprise plan
Identity and access
- Roles
- Owner, manager, driver/restocker, technician, finance, brand partner (read-only campaign view)
- Single sign-on
- SAML/OIDC on Enterprise
- Identity providers
- Connectors for Okta, Microsoft Entra ID and Google Workspace
Payments
- Card acceptance
- EMV contactless and mobile wallets
- PCI scope
- Built to support PCI DSS scope reduction through P2PE-capable readers from certified processors
- Processor
- Bring your own at no markup, or Kava Pay
Devices and availability
- Door lock
- Electromagnetic; opens only for an authorized tap, badge or app session
- Offline buffering
- 72 hours on every 8Kava device
- Uptime SLA
- 99.9%; 99.95% on Enterprise
- Monitoring
- Network Operations Center, 24/7/365
Everyone sees what their job needs, and nothing else
Owner
Full control of the account, billing, users and the guardrails Kava Agent works within.
Manager
Planograms, prices, routes and approvals for the sites they run.
Driver / restocker
Pick lists, routes and restock confirmation in the driver app. No financial reports.
Technician
Device health, temperature history and service tickets, without sales data.
Finance
Settlements, subsidies, payroll deduct and exports, without device controls.
Brand partner
A read-only view of their own campaigns. Never another brand's data, never device settings.
SOC 2-aligned, and we say exactly that
We design our controls around the SOC 2 Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. In practice that means least-privilege roles, encryption everywhere data moves or rests, single sign-on for Enterprise customers, and an audit log of every Kava Agent action, with one-click rollback for price changes.
We call these controls SOC 2-aligned rather than certified, because precision is part of security. If your team runs a vendor review, send us your questionnaire and we'll answer it in detail, with the people who built the system on the call.
Security includes staying up
What's the most sensitive thing your vending machine knows?
For most fleets it isn't a card number. With P2PE-capable readers, card data is encrypted at the reader before any platform sees it. The sensitive part is the pattern: who buys what, when, and on whose subsidy. Ask every vendor, including us, where that pattern lives, which roles can query it and what leaves the device in the first place.
Security questions
Does the Kava Cooler use facial recognition?
No. Recognition runs on the device and looks at products, not people. No images of faces are stored or sent, and Shopper Analytics reports only anonymous, aggregated traffic and dwell.
Where is our data hosted?
Kava OS data is hosted in US regions, encrypted in transit with TLS 1.2+ and at rest with AES-256. Enterprise customers can arrange custom data residency.
How do you handle card data and PCI scope?
Kava hardware is built to support PCI DSS scope reduction through P2PE-capable readers from certified processors, so card data is encrypted at the reader. You can bring your own processor at no markup or use Kava Pay. See payments for details.
Can we use single sign-on?
Yes, on the Enterprise plan. Kava OS supports SSO via SAML/OIDC, with connectors for Okta, Microsoft Entra ID and Google Workspace. See the Enterprise plan on our pricing page.
Can a brand see our sales data?
Only what their role allows. Brand partners get a read-only view of their own campaign results. They can't see other brands, other products' sales, device settings or anything about individual shoppers.
Where to go next
Send us your security questionnaire.
We'll answer it in writing and walk your team through access control, encryption and on-device recognition on a call.