How to check Kenveil before you buy
Kenveil asks you to trust it with how your accounts connect. So this page is a report you can check line by line: who runs Kenveil, where your money goes, what we store, what runs on your PC, and what isn’t done yet.
- You can check this yourself, from outside.
- Documented: written down in detail, not yet tested by anyone outside.
- Not yet: named plainly, with what to do meanwhile.
Who runs Kenveil
Kenveil is built and run by an independent security researcher.
Kenveil makes money one way: the licenses it sells. There are no ads, and no data is sold. The operator’s name and address are in the imprint, as German law requires. They stay there and nowhere else on the site, for the reason Kenveil exists in the first place: keeping what’s public about a person to a minimum.
You can still hold Kenveil to account. Every claim on this page links to where you can check it, the warrant canary is renewed every month, and card payments run through Stripe, which verifies the identity of everyone it pays out to.
Support is a ticket in your Kenveil account, answered by a person. Security researchers report through the disclosure policy.
Business information
- Selling since
- October 2026, on kenveil.com
- Servers and data
- In Spain, under EU privacy law
- Security reports
- Disclosure policy and security.txt
Legal documents
- Privacy policyVersion 2.2,
- Terms of serviceVersion 1.6,
- Refund policyVersion 1.3,
- Right of withdrawalVersion 1.0,
- ImprintVersion 1.3,
- Invite and partner termsVersion 1.0,
Paying
Where your money goes, and what happens if something goes wrong.
Card payments stay with Stripe
You pay on Stripe’s own checkout page. Kenveil receives the order number and the amount, never your card or bank details.
You can check thisWhat we receiveCrypto goes straight to our wallet
No payment company in between and no ID check. Your order page links your transaction on a public block explorer, so you can follow it yourself.
You can check thisHow buying worksOne payment, nothing renews
A license is bought once, for a set term or for life. There is no subscription, so nothing is charged again.
You can check thisThe plansA person reviews every refund
Open a “Payment or refund” ticket in your account, and a person answers. Your rights as a consumer, like EU withdrawal, stay as the law gives them.
You can check thisRefund policy
Your data
What Kenveil keeps, how it is protected, and whose accounts it looks at.
Every piece of data, listed
The Ledger names everything Kenveil stores: where it lives, why, how it is protected and when it is deleted.
You can check thisOpen the LedgerEncrypted with your own key
Your accounts, scans and alerts are encrypted with a key unique to your account. Deleting your account deletes that key with it.
DocumentedHow the encryption worksOnly your own accounts
Scans start from accounts you verified yourself. The app has no field to look up anyone else: you can see that the moment you open it.
You can check thisPrivacy by designEU servers, no trackers
Kenveil’s servers are in Spain, under EU privacy law. This website loads nothing from other companies and sets no tracking cookies: your browser’s network tab shows it.
You can check thisPrivacy policy
The app on your PC
What you install, and how to check it before you run it.
The installer has a published checksum
Every release is published with its SHA-256 checksum. Compare it with your download before you run the installer: the steps are below.
You can check thisCheck your downloadNo admin rights, no drivers
Kenveil runs as your own user. On Windows the installer doesn’t ask for admin rights; on Linux the .deb and .rpm install like any other app. There is no service, no daemon and no kernel driver.
You can check thisWhat runs on your PCYour hardware stays on your PC
A license knows your PC only by one-way hashes made on the PC itself. The raw hardware details never leave it.
DocumentedDevices and licenses
Accountability
Ways to hold us to all of the above.
A warrant canary, renewed monthly
A statement, renewed every month, that no authority has ordered us to hand over data or weaken the app. If it ever stops, that tells you.
You can check thisCheck the canaryA way to report vulnerabilities
Security researchers have a disclosure policy with a safe harbour, and a security.txt that says where to report.
You can check thisDisclosure policyLive status
Whether the service is running right now, checked by our own server and shown without tracking you.
You can check thisSee the statusChanges in the open
Every release is in the changelog, and what is being built next is on the roadmap.
You can check thisRead the changelog
Check your download
A checksum is the file’s fingerprint. If yours matches the one we publish, you have exactly the installer we released, unchanged on the way to you.
In the folder you saved the installer to, open PowerShell and run:
Get-FileHash .\Kenveil_0.3.4_x64-setup.exe -Algorithm SHA256The Hash it prints must match this, letter for letter:
not available yet
Tested by others
Free public tests run by other organisations. They check the website and the mail server from outside, not the app, so they don’t replace an audit. Each link opens the test’s own result page, where you can run it again.
Results from
Mozilla HTTP Observatory
The security headers the website sends, like the content security policy and HTTPS-only rules.
A+, 140 points, 12 of 12 passed
See the result of Mozilla HTTP Observatory (opens in a new tab)Qualys SSL Labs
The encryption of the connection to the website: TLS versions, ciphers and the certificate.
securityheaders.com
Each security header in the website’s response, and whether any is missing.
Webbkoll
What a visit gives away: cookies, requests to other companies, and the privacy headers.
No cookies, no third-party requests
See the result of Webbkoll (opens in a new tab)Blacklight by The Markup
Ad trackers, fingerprinting, session recording and social media pixels, found by opening the site like a visitor.
internet.nl website test
HTTPS, security headers, IPv6, signed DNS (DNSSEC) and route security, against current internet standards.
66%: HTTPS and headers pass, no IPv6 or DNSSEC yet
See the result of internet.nl website test (opens in a new tab)internet.nl email test
The server that receives Canary mail at mail.kenveil.com: encryption, DANE, DNSSEC, SPF, DKIM and DMARC.
52%: encryption passes, the DNS records are still missing
See the result of internet.nl email test (opens in a new tab)HSTS preload list
Whether browsers ship with kenveil.com on their built-in list of HTTPS-only sites.
Not on the list yet
See the result of HSTS preload list (opens in a new tab)VirusTotal
The current Windows installer, looked up by its SHA-256 checksum across dozens of virus scanners.
68 of 71 scanners find nothing. SecureAge and Trapmine (a low machine-learning score) flag it, as they often do with new installers that aren’t code-signed
See the result of VirusTotal (opens in a new tab)
Not done yet
Kenveil is new. These are the things a careful buyer should know are missing, and what to do until they aren’t.
The installer isn’t code-signed yet
PlannedOn Windows, SmartScreen warns the first time you run the installer from this site. Kenveil in the Microsoft Store, signed by Microsoft, is on its way.
Meanwhile: Compare the installer’s SHA-256 checksum with the one published here before you run it. Read more about the installer isn’t code-signed yet
Updates are installed by hand until the Store version is out
PlannedFrom the Microsoft Store, Kenveil will update itself. Until then, new versions are published on the download page.
Meanwhile: Look at the changelog now and then: every release comes with its checksum. Read more about updates are installed by hand until the store version is out
No independent security audit yet
Not scheduled yetKenveil’s security design is written down in full, but no outside firm has tested it yet. That is why some claims above say “Documented”.
Meanwhile: Read the security page, and report anything you find through the disclosure policy. Read more about no independent security audit yet
So far
Everything a buyer would care about, with the day it happened.
Kenveil 0.1.0 for Windows
The first public build, with all eleven tools and the Ledger of everything it keeps.
The shop opens
Licenses on the website, paid in crypto straight to Kenveil’s own wallets.
Card payments, and the warrant canary
Payments through Stripe, the EU withdrawal consent at checkout, the transparency report and the first canary.
Privacy policy 1.5
The current privacy policy: what we collect, why, who else receives it, and for how long.
Stablecoins, gifts and two-PC keys
USDT, USDC, EURC, DAI and PYUSD, gift cards to print, and one key for two PCs.
Kenveil for Linux
Version 0.3.0: a .deb, an .rpm and an AppImage, each with its SHA-256 on the download page.
In the Chrome Web Store
Kenveil for Chrome, Edge and Brave passed Google’s review and is listed in the Chrome Web Store.
Ask a person before you buy
Open a ticket in your Kenveil account about buying, payments, refunds, or whether Kenveil fits what you need. No account yet? Create one for free.