What we do to protect the records in a desk, said plainly — including the things we deliberately do not hold, and the certification we do not claim.
1. In Transit and At Rest
Every connection is HTTPS with a modern certificate. Records are encrypted at rest by the storage layer. There is no plain-text copy of your data sitting anywhere we control.
2. Who Can See It
Access on our side is limited to the people who need it to operate or support the service, and it is logged. We do not browse customer records for curiosity, for demos or for marketing.
3. Signing In
Desks are reached through an access code bound to a named account on our side, not a shared password passed around. A code identifies one account — it cannot drop whoever holds it into another company's desk.
4. Payments
🔴 We never see or store a card number. Payments run through Stripe, which is PCI DSS Level 1. Card details go from your customer's browser to Stripe and never touch our systems.
5. What We Deliberately Do Not Hold
We do not collect Social Security numbers, driver's licence numbers, bank login credentials or health records. The less we hold, the less there is to lose — that is a design decision, not an oversight.
6. Backups
Records are backed up on a rolling basis and restores are tested. A backup nobody has ever restored is not a backup.
7. Patching
The platform is updated as part of the lease. You do not run a version and you never have to schedule an upgrade.
8. Hosting
Cloudflare's network, in the United States, behind DDoS protection and a web application firewall.
9. Telling You
If something affects your records, you hear it from us, quickly, with what we actually know at the time.
10. Reporting a Problem
If you find a security issue, write to [email protected]. Tell us what you found and how to reproduce it. We will confirm we received it, and we will not threaten anyone who reports a genuine issue in good faith.
11. What We Do Not Claim
We are not SOC 2 certified and we do not say we are. We are a small New Jersey company that builds and runs software for local businesses, and we would rather tell you exactly what we do than wave a badge at you. Everything on this page is a description of how the service actually runs today.
Not Legal Advice
This page explains how we operate. It is not legal advice, and it does not replace an agreement you have signed with us. Where this page and a signed agreement disagree, the signed agreement controls.
Questions
Write to [email protected]. RunKeepAI, Elizabeth, New Jersey.