Privacy policy
Information we collect
KeylessSSL collects the following information when you use the portal and API:- Account information — name, email address, and organization details provided during sign-up and profile management.
- Domain data — the base domains you add, their DNS delegation records, and certificate metadata.
- Usage data — API requests, audit events, and page interactions within the portal.
- Authentication and credential data — Auth0 handles sign-in with passwords, passkeys, and authenticator apps. KeylessSSL stores API keys only as keyed HMAC-SHA256 hashes. Webhook signing secrets are stored encrypted, along with a hash.
How we use your information
Your information is used to:- Operate the domain verification and certificate issuance workflow.
- Enforce organization-level access controls and team roles.
- Track usage for billing and rate-limiting purposes.
- Send transactional emails for email verification and team invitations.
- Record immutable audit events for security and compliance.
Data storage and processing
Data is stored in a PostgreSQL database hosted on Azure. Authentication is handled by Auth0. Domain verification and certificate issuance involve communication with the Cloudflare API. Billing is processed through Stripe. Transactional email delivery uses Resend.Data retention
Account and domain data is retained for the duration of your account. You may request deletion by contacting support. Audit events are stored immutably.Third-party services
KeylessSSL uses these third-party services:- Auth0 — authentication and identity management.
- Cloudflare — domain verification and certificate issuance via Cloudflare for SaaS Custom Hostnames.
- Stripe — billing and subscription management.
- Resend — transactional email delivery.
- Azure — PostgreSQL database hosting.
- Sentry — error monitoring (no personal data intentionally included).
- PostHog — product analytics (configurable).