Privacy Policy

What we collect

• Account data: the email address and password (stored as an Argon2 hash, never in plain text) you register with.
• Stored secrets: whatever you send to the /v1/vault endpoint. This is encrypted before it's written to disk (see "How your data is protected" on the homepage).
• Audit metadata: timestamps, IP addresses, and action types (e.g. "vault.read", "auth.login") for every request — not the content of what you stored, just that an action happened.
• API key metadata: a name you give each key and its usage timestamps. The key itself is stored only as a one-way hash; we cannot look up or recover your raw key after it's issued.

What we can and can't see

Secrets are encrypted with a per-record key before storage, and that key is itself wrapped by a master key kept only in server memory. In practice this means a stolen database backup reveals nothing readable.

That said, honesty matters here: when you retrieve a secret through the API, it is briefly decrypted in server memory to be returned to you. This is not a zero-knowledge system — we are not able to read your stored secrets at rest, but the current architecture does not prevent server-side access to plaintext at the moment of a legitimate retrieval request.

How we use your data

• To operate the service — authenticating you, storing/retrieving what you ask us to, and enforcing rate limits.
• To maintain the audit log, which exists for your own security (so you can verify nothing was tampered with) and ours (abuse detection).
• To communicate with you about your account, if you contact us or if we need to reach you about a security matter.

We do not sell your data, and we do not share it with third parties for marketing purposes.

Where your data lives

Data is hosted on infrastructure located outside Kenya (a European VPS provider). If cross-border data residency is a requirement for your use case, contact us before storing regulated data — dedicated, in-region hosting can be discussed for Enterprise plans.

Retention and deletion

Stored secrets remain until you delete them via the API (DELETE /v1/vault/{id}) or close your account. Audit log entries are retained indefinitely by design — they're hash-chained specifically so they can't be selectively deleted without breaking the chain's integrity, which is itself a security feature.

To request full account deletion, email [email protected].

Your rights

Under Kenya's Data Protection Act, 2019, you have the right to access, correct, or request deletion of your personal data, and to object to certain processing. To exercise any of these, contact [email protected].

Changes to this policy

If this policy changes materially, we'll update the date above. Continued use of the API after a change constitutes acceptance of the updated policy.

Contact

DennisCreatives Data Solutions Ltd · Nairobi, Kenya
[email protected]