**Last updated:** 7 October 2026 KeyContain is a service operated by Debuggex Inc. ("KeyContain", "we", "us", "our") that lets you put fine-grained permissions in front of third-party APIs, so that software agents can use those APIs only in the ways you allow. This Privacy Policy describes the personal information we collect, the purposes for which we use it, the parties with whom we share it, the periods for which we retain it, and the rights available to you. We apply a single global standard to all customers. Rather than varying rights by location, we extend the protections of the most stringent applicable regime to every customer. **Data controller:** Debuggex Inc., 222 Finch Ave W #213, Toronto, ON M2R 1M6, Canada **Privacy contact:** support@keycontain.com --- ## 1. Information We Collect ### 1.1 Account Information - **Email address.** Your account identifier, used to sign in and to send verification and password reset emails. - **Organization name**, entered when you create your account and shown in the dashboard. - **Password-derived credentials.** Your password never leaves your browser. Your browser derives a separate sign-in key from it, and we store only a one-way verifier of that sign-in key. We cannot recover your password. - **Two-factor authentication**, if you turn it on: the authenticator secret, stored encrypted, and your two-factor recovery codes, stored only in irreversible form. - **Encrypted account keys.** Your browser creates your account's key pair and sends us only copies of its private key encrypted with keys derived from your password and from your recovery code. We cannot decrypt them. ### 1.2 Keys, Services and Permissions - **Upstream credentials** you attach to KeyContain, such as API tokens for QuickBooks, GitHub or GitLab. These are encrypted in your browser before they reach us, and a copy of our database or backups alone cannot decrypt them. They are decrypted in memory only to forward a request made with a KeyContain key you have authorized to use that service. - **KeyContain keys** you create. We store only a one-way lookup value and the key's public key, never the key itself. A key value is shown to you or delivered to your agent once. - **Configuration** you create: service names and base URLs, permission rules, IP address groups, limits, and notification settings. ### 1.3 Requests Made Through KeyContain When an agent uses one of your keys, the request passes through KeyContain to the upstream service and the response passes back. - **We do not store request or response bodies** of forwarded requests. - **Activity records.** For each request we record its time, the key and service used, the upstream URL (which may include query strings), the HTTP method, the outcome, status, sizes, the caller's IP address, and the purpose and reason your agent supplied. - **Requests awaiting confirmation.** When a request needs a person's approval, we keep a copy of it, encrypted, so that you can review it: its method, URL, headers other than credentials, and body. This copy is deleted as soon as the request is approved, declined or expires. - **Pairing requests** from agents asking to connect to your account, including the name the agent supplied, for the short time the pairing remains open. ### 1.4 Billing Information - Your balance, capacity, automatic top-up settings and a ledger of deposits and daily charges. - **Card details are collected and held by our payment processor, Stripe.** We receive only the card brand, the last four digits, the expiry date and Stripe's identifiers for your customer record and payments. We never see or store your full card number. ### 1.5 Device and Technical Information - **Session information** — your browser's user agent, used to show you where you are signed in and to let you sign out other sessions. - **Push notification identifiers**, where you enable notifications in a browser or in the KeyContain app. - **IP addresses**, used for the IP restrictions you configure, to apply rate limits, and to detect and slow down attempts to guess passwords or codes. - **Server logs**, which never contain request or response bodies, passwords, keys, upstream credentials or tokens. We do not use cookies other than the session cookie required to keep you signed in, and we do not use analytics, advertising or tracking technologies. --- ## 2. Purposes and Legal Bases | Purpose | Information | Legal basis (GDPR) | |---|---|---| | Creating and securing your account and authenticating access | Email address, organization name, password-derived credentials, two-factor information, session information | Performance of a contract | | Forwarding your agents' requests within the permissions you set | Keys, configuration, upstream credentials, requests in transit | Performance of a contract | | Showing you what your agents did and letting you approve or decline requests | Activity records, requests awaiting confirmation, pairing requests | Performance of a contract | | Charging for capacity and processing deposits | Billing information | Performance of a contract; legal obligation | | Sending notifications you have not disabled | Email address, push identifiers, notification settings | Performance of a contract; legitimate interests | | Applying rate limits, IP restrictions and protection against abuse | IP addresses, authentication records | Performance of a contract; legitimate interests | | Keeping the service secure and correcting faults | Server logs | Legitimate interests | We do not sell personal information, and we do not disclose personal information for cross-context behavioural advertising. The service does not display advertising. --- ## 3. Disclosure to Third Parties We engage service providers who process personal information on our behalf under written data processing agreements, and who receive only the information necessary for their function: | Service provider | Information disclosed | Purpose | |---|---|---| | Stripe | Email address, card details you enter, payment amounts | Processing payments and storing cards | | Mailgun | Email address and message content | Delivering verification and password reset emails | | Google (Firebase Cloud Messaging) | Push identifiers and notification content | Delivering push notifications to the KeyContain app | | Your browser's push service (for example Google, Mozilla or Apple) | Push subscription and encrypted notification content | Delivering browser notifications | | OVHcloud | All information we store, on servers we operate | Hosting | **Upstream services.** When an agent makes a request you have allowed, we forward it to the upstream service you configured, together with the credentials you attached for that service. What that service does with the request is governed by its own terms and privacy policy. We may also disclose personal information where required by law, including in response to valid legal process. --- ## 4. Retention and Deletion ### 4.1 Deleting Your Account You may delete your account at any time from Settings. Deletion takes effect immediately: every key stops working, and your account, keys, services, upstream credentials, permissions, activity records, confirmations, sessions and notification registrations are deleted from our active systems, and your customer record and saved card at Stripe are deleted. Any remaining balance is forfeited, except where applicable law requires a refund. Information held in our backups expires separately. The total period for which your information may persist in any form does not exceed **35 days** after deletion. An account that is created but never verified is deleted automatically after **7 days**. ### 4.2 Other Retention Periods - **Activity records** are retained for **90 days**. - **Requests awaiting confirmation** are deleted when they are approved, declined or expire. The record that a confirmation took place, without the request's content, is retained for **90 days**. - **Billing ledger, usage and warning records** are retained for **13 months**. - **Records of notifications sent** are retained for **30 days**. - **Sessions** end after 14 days without use and 30 days after sign-in, and are then deleted. - **Verification and password reset links** expire after 24 hours and 1 hour respectively and are deleted within 7 days. - **Rate limiting and sign-in failure counters** are deleted within 1 day. - **Server logs** are retained for no more than **90 days**. ### 4.3 Information Retained Following Deletion - **Payment records held by Stripe**, which Stripe retains under its own obligations and privacy policy. - **Information subject to a valid legal hold**, for the duration of that hold. --- ## 5. Your Rights Subject to applicable law, you have the right to: - **Access** the personal information we hold about you and obtain a copy; - **Rectify** inaccurate information, much of which you may amend directly in the dashboard; - **Erase** your account and associated information; - **Restrict or object to** processing carried out on the basis of legitimate interests; - **Receive your information in a portable format**; - **Withdraw consent** where processing is based on consent; and - **Not be subject to discrimination** for exercising any of these rights. To exercise any of these rights, contact support@keycontain.com. Because we cannot decrypt your upstream credentials or your account's private key, we cannot include them in a copy of your information; you can view or replace them in the dashboard while signed in. You are also entitled to lodge a complaint with a supervisory authority, including the Office of the Privacy Commissioner of Canada, your national supervisory authority within the EU or EEA, or the Information Commissioner's Office in the United Kingdom. These rights arise, according to your place of residence, under the GDPR, the UK GDPR, the Personal Information Protection and Electronic Documents Act (Canada), the California Consumer Privacy Act as amended, the Lei Geral de Proteção de Dados (Brazil), or comparable legislation. --- ## 6. Minimum Age The service is intended for adults acting for themselves or for an organization. You must be **18 years of age or older** to create an account. We do not knowingly collect personal information from any person under 18, and we delete any account we identify as belonging to such a person. --- ## 7. International Transfers We operate from Canada and engage service providers located in other jurisdictions. Personal information is accordingly transferred outside your country of residence. Transfers from the EEA and the United Kingdom to Debuggex Inc. in Canada are made in reliance on the adequacy decisions adopted by the European Commission and by the United Kingdom in respect of Canadian organisations subject to the Personal Information Protection and Electronic Documents Act. Transfers to service providers established elsewhere, including in the United States, are made in reliance on Standard Contractual Clauses together with the safeguards set out in our agreements with those providers. You may obtain further information about these safeguards by contacting support@keycontain.com. --- ## 8. Security We maintain administrative, technical and physical safeguards designed to protect personal information against unauthorised access, alteration, disclosure and destruction. These include: - passwords that never leave your browser, and upstream credentials and account keys encrypted in your browser so that a copy of our database or backups alone cannot decrypt them; - KeyContain keys, sessions, tokens and recovery codes stored only in irreversible form; - optional two-factor authentication; - encryption of information in transit; - protections that stop requests from being forwarded to private or internal network addresses; and - restriction of staff access to those with a legitimate need. No method of transmission or storage is entirely secure, and we do not warrant absolute security. If you lose both your password and your recovery code, we cannot recover your upstream credentials for you. --- ## 9. Changes to This Policy We may amend this Privacy Policy from time to time. Where an amendment is material, we will provide notice in the dashboard or by email before it takes effect, and will update the date stated above. --- ## 10. Contact support@keycontain.com Debuggex Inc. 222 Finch Ave W #213 Toronto, ON M2R 1M6 Canada