Privacy

This page covers Keyring as a whole: this website, the dashboard, the control plane API and the SDKs as they talk to the control plane. It was last updated on 26 September 2026.

Who is responsible

Keyring is operated by Abdelmounaim Belghalem EI (SIRET 91835271700048), which is the data controller for the data described under “Your account” below; see the legal notice. For anything on this page, write to hello@keyringdev.com.

This website

This site sets no cookies, loads no analytics and embeds nothing from a third party. Fonts and scripts are served from the same server as the page. Your theme choice is kept in the local storage of your browser and never leaves it. The server keeps a standard access log with your IP address, the time and the address you asked for, to keep the service running.

Your account: we are the controller

When you sign up and use the dashboard or the control plane API, we keep:

• your email address, your name if you give one, and a hash of your password (never the password itself);
• your sessions, stored as hashes, and the single session cookie the dashboard needs to keep you signed in;
• your workspaces, memberships and invitations, and a billing email if you set one;
• an audit log of changes made in your workspace, which names the person who made each one;
• emails you send us and our answers.

We use this to run your account, to secure it, to send you the emails the product needs (address verification, password resets, invitations, security alerts about a leaked key, spend warnings) and to answer you. The legal basis is the contract between us, and our legitimate interest in securing the service. We send no marketing email and sell nothing to anyone. API keys are stored as hashes; nobody, us included, can recover one in plaintext.

Your customers’ data: we are the processor

When your API runs our SDK, the control plane receives, on your behalf:

• the tenant identifiers you create for your own customers, and the names you give them, if any;
• request metadata sent by the SDK: time, method, path, route, status, duration, which key and tenant made the request and why a request was refused;
• rate limit counters, and for a request that carries an Idempotency-Key header, the stored response so that a retry can be replayed, kept for 24 hours by default and 7 days at most.

We process this data only to provide the service to you, on your instructions, and for no purpose of our own. You decide what goes in a tenant name and in a response your API returns, so keep personal data out of them where you can. A data processing agreement is available on request at hello@keyringdev.com. It is not published yet, and we will write it with you when you ask.

Subprocessors

The control plane runs in the EU only, with no US replica and no US failover. These companies process data on our behalf:

Stripe holds your payment details; we never see a card number. Resend and Stripe are part of US groups: any transfer outside the EU is governed by their own safeguards, and we make no promise about where Stripe stores its data. Only the control plane itself runs in the EU. We will update this list before adding a subprocessor.

How long we keep it

Account data stays while your account exists. Expired sessions, used password reset and verification links, and sent notifications are deleted on a schedule. Request metadata is kept for as long as it is needed to show you usage and to count billable tenants. Encrypted backups are kept on our host in France. To have your data deleted sooner, write to hello@keyringdev.com.

Your rights

You can ask to access, correct, export or delete your data, or object to how we use it, by writing to hello@keyringdev.com. For data we process for a Keyring customer, we pass your request to that customer, who decides. You can also complain to your data protection authority.