Redaction first. Honest about the rest.

What we store

Metadata and redacted payloads by default. Full-payload storage is opt-in per agent and encrypted.

PII redaction

Emails, phones, card numbers (Luhn), Aadhaar, PAN, IBAN, API-key patterns and your own JSON paths are redacted in the gateway before anything is persisted.

Encryption

TLS 1.2+ in transit, encryption at rest via the provider, plus libsodium for secrets and payload blobs with key versioning.

Upstream credentials

Write-only. Never logged, never returned by the API.

Retention

Per plan (7, 30 or 90 days) with a nightly purge. The audit log is kept one year.

Access control

RBAC. Approvers cannot edit rules. Revealing a full payload needs admin and writes an audit entry. Approval links open a confirm page, so email scanners cannot auto-approve.

App security

zod validation at every input, CSRF on cookie routes, rate limiting, SSRF protection on upstream URLs, regex timeouts and sandboxed expressions.

Tenant isolation

org_id on every row, Postgres row-level security, plus tests that try cross-tenant access.

Fail open or closed

If Keeprun errors, calls fail open by default and are logged unchecked. Payments and refunds can fail closed.

Region

Hosted in our free-tier provider's region, stated honestly. We do not claim regions we do not use.