Kavanati for IT — security & privacy brief
Last updated: 20 October 2026 · describes version 1.14.2
1. What IT can verify and control
| Item | Fact (verified against the shipped app) |
|---|---|
| Privilege | Runs as a standard user: no admin rights, no driver, no Windows service. |
| Network | One host only, kavanati.com, over HTTPS (TCP 443). No analytics, advertising or crash-reporting SDKs in the app. |
| What leaves the computer | Update check, license check (paid plans), and feedback or a diagnostic log only when the user chooses to send them. Typed text never. |
| What is stored | A settings file and a small log in the user profile, in plain text. Section 5. |
| Central controls | License key by registry policy, license file or MDM profile (silent activation). A switch that turns self-update off. |
| Removal | Menu item "Uninstall Kavanati…" (removes autostart, the Start Menu shortcut, the settings and the program file), or delete the file. The Store version uninstalls like any Store app. |
| Questions from your security team | support@kavanati.com answers questionnaires and vulnerability reports. |
2. Deployment
- Windows: the direct download is one portable file (about 50 MB) with no installer and no admin rights; it runs per user. The Microsoft Store version is the signed alternative. An MSI installer and an ADMX template are not available yet.
- Mac:
Kavanati.app, Developer-ID signed and notarized. Each user approves Accessibility and Input Monitoring once (Accessibility can be pre-approved with a PPPC profile; Apple does not let MDM pre-approve Input Monitoring). - License key:
HKLM\SOFTWARE\Policies\KavanativalueLicenseKey(or the same under HKCU), aKavanati.licensefile next to the exe, or on Mac thecom.melogix.langguardpreferences domain. Every computer activates itself silently and takes one seat. Only a Business key can be deployed this way. - Updates:
SelfUpdate= 0 in the same policy key (Mac: boolean in the same domain) makes the app show that a version is available and never download or replace anything.
Step-by-step guide with a sample script: kavanati.com/deploy.
3. Antivirus and EDR
To notice wrong-layout typing, Kavanati installs a low-level keyboard hook (Windows) or a Quartz event tap (macOS) and sends synthetic key events to make a fix. Behavior-based tools such as Microsoft Defender for Endpoint, CrowdStrike Falcon or SentinelOne may flag that technique (MITRE ATT&CK T1056.001) on behavior alone. We have not tested against each product; if one blocks it, the identifiers below are what to allow.
| Windows: Microsoft Store (MSIX) | Windows: direct download | macOS | |
|---|---|---|---|
| Code signing | Signed by Microsoft when it certifies the package. | Not code-signed yet (no Authenticode signature). SmartScreen asks for confirmation on first run; Smart App Control or company policy may block it. | Developer ID, team LJ373NJ3QV, hardened runtime, notarized and stapled. |
| Identify it by | Package identity 301210704.Kavanati (Store ID 9MWFV3KBLFV2), not by file hash. | Kavanati-windows.exe, product name Kavanati; allow by SHA-256 (changes every release) or by path. | Bundle ID com.melogix.langguard, executable Contents/MacOS/Kavanati.Mac. |
| Updates | Delivered by the Store; the packaged app never updates itself. | Self-update downloads Kavanati-windows.exe.new next to the app, renames the running file to .old and restarts; or turn it off (section 2). | Downloads to $TMPDIR/kavanati-update.zip and runs a short script that replaces the bundle; or turn it off. |
| Also | Settings folder %APPDATA%\LangGuard\ (the original internal name); mutex LangGuard.SingleInstance. | Same. | Runs /usr/sbin/ioreg once at start-up to read the hardware ID for the license fingerprint. |
Recommendation for organizations: deploy the Microsoft Store (MSIX) build on Windows, because Microsoft signs it and there is no SmartScreen prompt. The managed license policy is read from the registry in both Windows builds; confirm the setup in your pilot. If you must use the direct download, allow it by path and hash and get it only from kavanati.com (compare the file's hash with version.json).
4. Network
The app contacts one hostname: kavanati.com, HTTPS on TCP 443. Nothing else is contacted by the app. (Paying happens in the user's browser on our website, not inside the app. The Store version is updated by Microsoft's Store.)
| Request | When | Why, and what it carries |
|---|---|---|
GET /version.json | At start-up, then every 6 hours | Update check and the signed plan policy. Carries platform, app version, a first-check marker and the anonymous device id (a one-way hash of the machine id). Nothing typed. |
GET /Kavanati-windows.exe or /Kavanati-mac.zip | Only when a newer version exists and self-update is on | The update, checked against the SHA-256 in version.json. |
POST /api/license/activate, /refresh, /release | Paid plans only: when a key is entered, at start-up and at most every 12 hours | License key, device fingerprint, platform and app version. Never on the free plan, never for offline-activated computers. |
POST /api/uninstall | Only when the user picks "Uninstall Kavanati…" | Device id, platform and version. |
kavanati.com/feedback (opened in the browser), POST /api/log | Only when the user chooses to report, give feedback, or agrees to attach the log | Whatever the user sends. The log has app events and app names, no typed text. |
If IT blocks kavanati.com completely: fixing keeps working, because it happens on the computer. Updates do not arrive, and a paid license is trusted for 30 days after its last successful check (section 6). Feedback and the update notice simply fail quietly.
5. What the app sees and stores
- Keystrokes: processed in memory, per key press: the key code, the active keyboard layout and the name of the foreground process. The word being typed, up to six earlier words and the last fix are held in memory only, and cleared on Enter, a click, an app switch, navigation keys or shortcuts, and after two minutes without typing.
- Field context: to judge the language of a field, the app can read the focused field's text through the accessibility interface (UI Automation on Windows, the Accessibility API on macOS). It is examined in memory and never stored or sent.
- Password fields: fields the operating system marks as password fields are skipped entirely: no buffering, no fix, no reading of the text. A prompt the system does not mark (for example a
sudoprompt in a terminal) is treated like other typing: in memory, never sent. - Manual whole-line fix: copies the line through the clipboard, converts it, pastes it back and restores the previous clipboard text. Clipboard-history tools may record that line.
- On disk:
%APPDATA%\LangGuard\settings.json(Mac:~/.config/LangGuard/settings.json): switches, per-app rules, protected words, the personal dictionary (up to 500 words per language), the license key and signed token, the daily counter.langguard.log: app events only, no typed text, cleared at every start and capped near 512 KB. Plain text in the user profile, protected by the operating system.
6. Continuity: if our servers are unreachable
The detection and the fixing run on each computer and need no connection. If kavanati.com becomes unreachable, even for good, installed copies keep running. What changes, exactly as the app is built:
- Paid license: trusted for 30 days after the last successful check. After that the app treats the computer as being on the free plan (a daily limit on automatic fixes; manual fixes stay unlimited), without locking anything, until a check succeeds again and restores the paid plan.
- Computers that never connect: an offline activation code, issued by us on request, keeps the paid plan for 400 days.
- Updates and plan policy: no new versions arrive; the last verified plan policy stays in force.
We do not promise anything beyond this. If continuity of paid features matters to you, ask us about offline activation for your environment.
7. Updates and integrity
- Every release publishes the SHA-256 of both builds in
version.json. The app verifies a downloaded update against it, discards it on a mismatch and applies it when the user restarts. version.jsonis served over HTTPS. Only the plan policy inside it is separately signed; the file itself is not.- Windows direct download: not code-signed. Windows Store: signed by Microsoft. macOS: Developer ID, notarized (check with
spctl -a -vv /Applications/Kavanati.app).
8. Vendor questionnaire: common answers
Is it a keylogger?
No. It needs the same keyboard access a spell-checker or layout switcher needs, and uses it to compare the current word with the keyboard layout. The word is held in memory for a moment and discarded; nothing typed is written to disk or sent anywhere. The log has no typed text. Sections 4 and 5 list every request and every stored item, so your team can verify it.
Does it send what users type anywhere?
No. The only requests are those in section 4, and none carries typed text.
Can it change text in a legal document without the user noticing?
A fix replaces a word in place as the user types, so it appears on screen, and one Ctrl+Z (⌘Z on Mac) right after it restores exactly what was typed. A word the user undoes becomes a protected word and is not touched again. In the Business plan, an organization dictionary (company, client and product names, from version 1.14) is never "fixed", and Kavanati can be turned off in chosen apps (today per user in the Rules window; centrally for everyone from version 1.14). For regulated work we recommend a pilot in those apps first.
Does it work in Citrix, RDP or VDI?
We have not tested VDI and roaming profiles, and the license seat is tied to the machine, not the user. Contact us for a pilot test in your environment.
Does it need admin rights?
No. Standard user, no driver and no service. On Mac, each user grants Accessibility and Input Monitoring once.
Is there a DPA?
The app does not process personal data from your users’ typing. Our servers hold the license key, an anonymous device hash, the platform and app version, and the purchaser’s business contact. On request we provide a signed statement from Engineering & Development Services (שירותי הנדסה ופיתוח, the legal entity behind Kavanati) describing this.
Which third parties are involved?
Paddle, the merchant of record for card purchases. Cloudflare hosts kavanati.com, the downloads and the license service. The app itself contains no third-party analytics, advertising or crash-reporting code. The website uses analytics; the app does not.
Do you hold security certifications?
We do not claim any (such as SOC 2 or ISO 27001). What we offer is this brief, the security overview, signed Mac and Store builds, and answers to your questions.
Can we turn off updates?
Yes. SelfUpdate = 0 (section 2). You then ship new versions yourselves.
How do we report a vulnerability?
Email support@kavanati.com. The same address answers security questionnaires, and our security.txt lists it.
Questions from IT, procurement or security: support@kavanati.com. See also the security overview, the deployment guide and Kavanati for teams.