Privacy Policy

Who we are

KeyCustody is key custody management software: it helps organizations track physical keys, keypad and lockbox codes, safe combinations, PINs, and fobs — and prove who had access, when, and why. KeyCustody is not cryptographic key management, password management, or crypto/asset custody, and this policy does not describe those kinds of services.

Information we collect

We collect three broad categories of information:

• Account information — your name, work email address, and organization, used to create and secure your account and to identify you within your organization's workspace.
• Customer content — the records your organization enters to run its custody workflow: locations, areas, people, access points, credential metadata, custody events, and related notes. By default we store facts about a secret (what it controls, who is authorized, rotation history) rather than the secret value itself; a value is only ever stored if an organization admin explicitly enables encrypted secret storage for that purpose.
• Usage and activity data — activity logs of sensitive actions within your organization's workspace (always on, and cannot be disabled — this is a design commitment, not just a default), plus standard technical data like IP address, browser/device information, and timestamps.

How we use information

We use the information above to:

• Provide, operate, and maintain the KeyCustody service for your organization.
• Secure the service and your account, including detecting and responding to security issues and enforcing our terms.
• Communicate with you about your account, support requests, and service updates.
• Understand how the service is used so we can improve it.

Tenant isolation

Each customer organization's data is isolated from every other organization's by construction: every record is scoped to the organization that owns it, and every query that reads or writes it is checked against your organization membership before it runs. Data is encrypted in transit. We do not use one customer's data to serve another customer.

How we share information

We do not sell your information and we do not share it for cross-context behavioral advertising. There is no advertising on KeyCustody. We share information only in these limited circumstances:

• Service providers — vendors who process information on our behalf to help run the service, such as authentication, hosting/database infrastructure, error monitoring, and (if you subscribe to a paid plan) billing. These vendors are bound to use information only to provide their service to us, not for their own purposes.
• Legal reasons — if required by law, legal process, or to protect the rights, property, or safety of KeyCustody, our customers, or others.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to standard confidentiality obligations.

Data retention

Custody, disclosure, and rotation records are append-only: history is corrected by adding a new event, never by rewriting or deleting the record. Account information is retained while your account is active and for a reasonable period afterward for legal, security, and record-keeping purposes. When your organization's subscription ends, we work with your organization on data export and deletion consistent with your agreement with us.

Security

We take reasonable technical and organizational measures to protect information, described in plain language on our Security page. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Your rights and choices

Depending on where you live, you may have rights to know what personal information we hold about you, request a copy, correct inaccuracies, or request deletion. See Your Privacy Choices for how to make a request and what to expect. If your organization manages your KeyCustody account, some requests may need to be fulfilled through your organization's administrator, since the underlying records belong to that organization, not to us individually.

Children's privacy

KeyCustody is a business tool and is not directed at children. We do not knowingly collect personal information from children.

International data transfers

KeyCustody is operated from, and information is processed and stored in, the United States. If you access the service from outside the United States, your information will be transferred to and processed in the United States.

Changes to this policy

We may update this policy as our practices evolve. We will update the "Last updated" date above, and for material changes we will provide reasonable notice.