Security

Reporting a vulnerability

If you believe you have found a security issue in this website or in the yourKEYtoIT platform, use our contact form and choose Security or privacy. Please include:

• What you found and where — a URL, endpoint or screen
• The steps needed to reproduce it
• What an attacker could do with it
• How you would like to be credited, if at all

We will acknowledge your report and keep you informed while we investigate. We ask that you give us a reasonable opportunity to fix an issue before disclosing it publicly, and that you avoid accessing, modifying or deleting data belonging to anyone else while testing. We will not pursue legal action against researchers who act in good faith within those bounds.

We do not currently run a paid bug bounty program.

What we do not claim

Security pages are often written to imply more than is true, so to be explicit:

• yourKEYtoIT does not hold a SOC 2, ISO 27001 or equivalent third-party certification, and we will not describe ourselves as certified, aligned or compliant with one.
• We do not claim any government or sector-specific accreditation.
• We have not commissioned an independent penetration test of the platform to date.

If your procurement process requires any of the above, tell us at the start of the conversation. We would rather say so plainly than waste your time.

How we build

These are the controls the platform actually enforces today, described plainly. Where you need more detail for a security review, ask us and we will answer the specific question.

• Separation between customers. Row-level security is enabled on every table in the database, so one organization's data is isolated from another's at the data layer — not just in the interface.
• Encryption in transit and at rest. All traffic to this site and to the platform is served over HTTPS/TLS, and the managed database encrypts stored data at rest.
• Role-based access. Five roles (owner, admin, manager, member and viewer) decide what each person can see and do. Viewers can read and comment but not change records.
• Single sign-on. Teams can sign in through their own Microsoft Entra ID (SAML), so authentication — including your organization's multi-factor policy — stays with your identity provider.
• Recorded change. An audit history records who created, changed or deleted records, with the person and timestamp, rather than allowing silent edits in place.
• Backups. The database is backed up automatically every day.
• Secrets kept out of code. API keys and credentials live in managed secret stores, never in the application code or the source repository.
• Least access to production. Access to production systems is limited to the operator who runs the service.
• Data you can take with you. Your data is yours — we will provide an export or delete it on request. See the privacy policy.

Who processes your data

We keep the number of vendors that touch customer data small. The subprocessors we rely on are:

• Supabase — the managed Postgres database, authentication and file storage (United States region).
• Cloudflare — hosting, content delivery, TLS and edge protection.
• Stripe — payment processing for subscriptions. Stripe handles card details; we never see or store them, and Stripe does not receive your project data.
• Anthropic — the AI model behind the features listed under AI features and your data. Usage is rate-limited and capped.
• Brave Search — receives the vendor and model line of a device when you use the asset specification lookup, so a suggestion reflects current hardware rather than the model's recall. It is sent a phrase of the form “Dell Latitude 5450 specifications cpu ram storage price” and nothing else — no serial numbers, no asset tags, no custody records, no person, and not your organization's name.

AI features and your data

Several features send text to a large language model. This section says exactly which ones, what they send, and what happens to it — because "we use AI" is not an answer a security reviewer can accept.

The model

One model, from one vendor: Anthropic Claude Haiku 4.5. Requests go directly from our backend to Anthropic's API over TLS. No other AI provider receives your data, and no request passes through a third-party AI gateway, broker or aggregator.

Which features use it, and what they send

• Ticket triage (Service Desk) — the subject and body of a ticket, whether it arrives through the portal, by email, or from a monitoring alert.
• Delivery-risk forecast (Project Delivery) — computed schedule facts, the project's existing risk register, change records, and vendor and contract exposure. Schedule dates, WBS codes and record titles, not attachments.
• Contract review (Vendor Scope & Accountability) — the contract title and the contract text you ask it to review, truncated to a fixed length.
• Writing assistance — the specific passage of text you select and ask it to improve.
• Asset specification lookup (IT Inventory) — the vendor and model line of a device you are adding, such as “Dell Latitude 5450”, with its age and condition. Not your serial numbers, asset tags, or who holds the device. This one also queries a web search first; see Brave Search under who processes your data.

Nothing else is sent. Per-vendor TPRM risk assessments and coverage reconciliation are deterministic and scored in your browser — no model is involved and no data leaves for them.

Training

We call Anthropic's commercial API. Under the Anthropic Commercial Terms of Service, inputs and outputs submitted through it are not used to train Anthropic's models. We do not use your content to train any model of our own, and we do not have one.

Retention

We log the fact of each AI call — the organization, the feature, the model name, and token counts — so usage can be metered and capped. We do not store the prompt or the model's response in that log. The model's output is written back only where you would expect to find it: the risk it drafted, the triage suggestion on the ticket, the contract review attached to the contract. Delete that record and the output goes with it.

Retention on Anthropic's side is governed by their commercial terms and their current data-retention practice, which we do not control. We have not contracted for zero data retention, and we do not pin a processing region — if either is a requirement for your organization, raise it before you buy rather than after.

Limits on what the model can do

• It advises; a person decides — with one exception. Ticket triage writes the category and priority it determines straight onto the ticket, so a queue is sorted the moment work arrives. Both are ordinary fields anyone can change, and the change appears in the audit history. Everything else is a suggestion a person accepts or rejects: a drafted risk, a suggested next step, a contract review, a specification. The model cannot create a record, close a ticket, send a reply, or reassign work.
• Your content is data, not instructions. Project, task, ticket and contract text is passed to the model marked as reference data, so text inside a record cannot redirect the model's behavior.
• Capped. There is a per-organization daily ceiling on AI calls, enforced in the database rather than in the interface.
• There is no per-organization switch. These features are on for every organization whose plan includes them, and there is no setting that turns them off for your account alone. Each has a deterministic fallback that runs when the model is unavailable — triage and forecasting keep working on rules — but that is a failure path, not a control you hold. If AI processing is not acceptable to your organization, raise it before you buy rather than after, as with retention and processing region above.
• Contract review is not legal advice. It is a review aid, and says so wherever it appears.

Questions for a security review

Send security questionnaires, architecture questions and data-protection questions through our contact form, choosing Security or privacy as the topic.

Last updated 22 July 2026.