How Kavach Works

Review first. Ship confident. Recover instantly.

Kavach is built around a simple belief: the most important thing you can do before a production deployment is have a human read the code. Everything else — monitoring, rollbacks, alerts — is there for when production surprises you anyway.

Connect your repository

One authorisation. Every branch, every push.

Sign in with GitHub, GitLab, or Bitbucket and grant Kavach read access to your repo. The moment a pull request is opened or a branch is pushed, Kavach queues it for review. Nothing ships without first passing through the review pipeline.

OAuth-based authorisation — no SSH keys or deploy tokens to manage

Works with monorepos: map any sub-directory to a Kavach project

Every push automatically triggers the review queue — no manual steps

Private repos supported on all paid plans

Manual code review

A human reads the diff. Every time. No exceptions.

Before any build is eligible for deployment, a Kavach reviewer reads the exact changes in that pull request — line by line. They are looking for logic errors, unintended behaviour in model interaction code, and anything that automated tests were not written to catch. The build is blocked until review is cleared.

Reviewer reads every changed file in the deployment diff

Model interaction changes — prompts, context windows, model versions — get specific scrutiny

Structured checklist ensures nothing is left to memory or intuition

Review outcome and any flagged issues are logged permanently in the audit trail

Security review

Auth, secrets, data access — reviewed before they reach production.

Any change that touches authentication flows, API endpoints, secrets handling, or data access patterns triggers a dedicated security review pass. The reviewer checks for hardcoded credentials, over-permissioned endpoints, prompt injection vectors, and dependency risks. Your users' data is protected before the code ships — not after an incident.

Secrets and credentials audited — no plaintext keys, no accidental logging

Prompt injection and input validation reviewed on every model interaction change

New dependencies checked for known CVEs and suspicious transitive packages

Security review is mandatory — it cannot be skipped or overridden

Deploy with confidence

Review cleared. Automated checks pass. Ship it.

Once review is cleared, Kavach runs automated pre-deploy health checks and cuts traffic over — zero downtime, full audit trail. You know exactly what is shipping, who reviewed it, and what was checked. No surprises.

Automated smoke tests run before traffic is cut over — bad builds never reach production

Zero-downtime deployments: new version warms up before old one is drained

Build logs streamed live to your dashboard as the deploy runs

Full audit trail: who reviewed, who approved, when it shipped

Monitor in real time

Every metric, every request, every error — visible instantly.

The moment your app is live, Kavach starts collecting metrics. Uptime, response times, error rates, AI model latency, and cost per request all appear on your dashboard within seconds. No agents to install, no SDKs to add to your code.

Metrics appear within seconds of first traffic — no warm-up period

AI model latency tracked per-provider and per-model version

Cost per request tracked in real time — not just at billing time

Structured logs streamed in real time with full-text search

Get alerted. Roll back instantly.

When production surprises you, recovery takes seconds — not minutes.

Kavach watches your thresholds continuously. The moment an error rate spikes or latency degrades, you get a notification via email, Slack, or webhook. If the issue is a bad deploy, roll back to the last reviewed stable version in under 10 seconds — no rebuild required.

Alert delivery in under 30 seconds of threshold breach

One-click rollback to any previous reviewed deployment snapshot

Automated rollback policies: define thresholds that trigger rollback without human intervention

Post-rollback validation confirms the previous version is stable before closing the incident

Common questions

Who does the manual code review — Kavach staff or my team?

Kavach provides trained reviewers who are familiar with AI app architecture, common security pitfalls, and production failure patterns. On Enterprise plans, you can also nominate members of your own team as required approvers — so your senior engineers are in the loop on every production change.

How long does a review take? Will it slow down my deploys?

Standard reviews are completed within 2 hours on business days. Urgent reviews — flagged as such in the dashboard — are prioritised and typically completed within 30 minutes. For teams shipping multiple times a day, reviews run in parallel with your CI pipeline so the review is usually ready by the time your build finishes.

What exactly does the security review check?

The security review covers: hardcoded or improperly handled secrets, over-permissioned API endpoints, input validation gaps that could enable prompt injection, new dependencies with known CVEs, changes to authentication or session handling, and any code that accesses or returns user data. The checklist is consistent across every review.

Can I bypass the review for a hotfix?

Yes — hotfix deployments can be expedited with a single reviewer sign-off rather than the full review process. The hotfix path is logged, flagged in the audit trail, and automatically queued for a full retrospective review within 24 hours. You can move fast when you need to without permanently skipping the safety net.

Do I need to change my code to use Kavach?

No. Kavach works at the infrastructure and review layer — it connects to your Git repo, reads your diffs, and wraps your deployment pipeline with review gates and monitoring. You do not need to add any SDK, agent, or library to your codebase.

Ready to ship with a reviewer in your corner?

Join the waitlist and be among the first to onboard when Kavach launches on 1st January 2027.

Join the Waitlist Explore all features