Privacy Policy

KeeperHub ("we," "our," or "us") operates the KeeperHub platform, including the web application at app.keeperhub.com, the marketing site at keeperhub.com, and related services (collectively, the "Service"). This Privacy Policy explains how we collect, use, store, and protect your information when you use the Service.

By using KeeperHub, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

KeeperHub supports OAuth-based authentication for connecting third-party services to your workflows. When you authorize a third-party connection:

• Tokens are stored server-side, encrypted at rest using AES-256.
• Tokens are never exposed to the client-side application or included in API responses.
• Refresh tokens maintain connections without re-authentication.
• Revoke any connection from your account settings, which immediately deletes stored tokens.

Workflow configurations may reference API keys, RPC endpoints, or other secrets:

• Stored as encrypted environment variables, separate from workflow data.
• Decrypted only at execution time in isolated server-side runtimes.
• Never transmitted to third parties, logged in outputs, or included in analytics.
• Rotate or delete stored secrets at any time from the platform.

KeeperHub exposes a Model Context Protocol (MCP) endpoint for AI assistants and development tools to interact with your workflows:

• All requests authenticated using session-based or token-based credentials.
• Scoped to your account and organization. No cross-tenant access.
• Data includes workflow schemas, execution commands, and status responses. No credentials in responses.
• All traffic encrypted in transit using TLS 1.2 or higher.

We use the following third-party services:

We do not sell, rent, or share your personal data with third parties for marketing purposes.

We retain data for as long as your account is active. Specific periods:

You have the right to:

Contact [email protected] to exercise these rights. We respond within 30 days.

Industry-standard security measures protect your data:

• Encryption at rest (AES-256) for all sensitive data including credentials and API keys.
• Encryption in transit (TLS 1.2+) for all communications between your browser and our servers.
• Role-based access controls and organization-level data isolation.
• Regular security audits and dependency vulnerability scanning.

No method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

EEA residents have additional rights under the GDPR:

• Legal basis -- contractual necessity, legitimate interest, and consent.
• Data portability -- request data in a structured, machine-readable format.
• Right to object -- object to processing based on legitimate interest at any time.
• Supervisory authority -- lodge a complaint with your local data protection authority.

California residents have rights under the CCPA:

• Right to know -- request details about collected personal information.
• Right to delete -- request deletion, subject to certain exceptions.
• Non-discrimination -- no discrimination for exercising your rights.
• No sale -- we do not sell personal information to third parties.

We use cookies for authentication and analytics:

We may update this policy from time to time. Material changes are posted here with an updated date. For significant changes, we may send an email notification. Continued use after changes constitutes acceptance.

Questions about this policy or our data practices: