Privacy policy
This policy says what we store, what we publish, for how long, and where. It is specific to this product; where a decision has not been made yet it says so.
Last updated 2026-10-05
Who we are. [OWNER: company legal name], operating AuditKit at auditkit.dev and api.auditkit.dev ("we"). Contact: support@auditkit.dev. For data you send through the API, you are the controller and we are the processor; for your account, we are the controller.
What we store
| Data | Why | How long |
|---|---|---|
| Your login email, account id, creation time | To sign you in (magic link) and to know which projects are yours | Until you delete the account |
| Magic-link tokens | Passwordless sign-in | 15 minutes or first use |
Session cookie ak_session (httpOnly, SameSite=Lax) | Keep you signed in to the dashboard | Until sign-out or expiry; no other cookies, no analytics cookies |
| API key hash (SHA-256) and prefix, scopes, mode, creation and revocation times | Authenticate API calls; we never store the key itself | Until revoked, then as a revoked record |
| Events you send: tenant id, actor, action, target, time, position, hashes, server signature, your optional client signature | The product: a chained, signed, anchored log | Indefinitely while the project exists; headers and hashes are kept past the retention window so old exports still verify |
| Event payloads (any JSON you send) and a per-event random salt | Readable detail; the salt makes the commitment unlinkable once deleted | Plan retention window (30 days, 1 year, 3 years), or until you erase the event, whichever is first |
| Merkle roots, Rekor and OpenTimestamps receipts | Public anchoring | Indefinitely |
| Viewer tokens: tenant, expiry, hash of the token | Read-only sharing with auditors | Until expiry or revocation |
| Stripe customer and subscription ids | Billing | While the subscription exists; card data never touches our servers |
| Server logs: IP address, request path, status, timing | Operations and abuse prevention (the public demo is rate-limited per IP) | [OWNER: fill, e.g. 30 days] |
The public demo on the homepage keys a throwaway tenant to a hash of your IP address; the demo project is reset nightly.
What we publish
Root hashes only. Every anchor interval we write one SHA-256 global root to Sigstore Rekor and OpenTimestamps, and list it on /anchors. A root is a hash of hashes; it does not reveal event contents, counts per tenant, actor names or project names. Public entries in Rekor and Bitcoin cannot be deleted by us or anyone; this is the point of the product, and it is why only hashes go there.
Personal data in events, and erasure
You decide what goes in actor, target and payload. If you put personal data there, the GDPR right to erasure is met by crypto-shredding: POST /v1/erase/:id deletes the payload and its salt and leaves the hash commitment, so the chain still verifies. This follows the pattern the EDPB describes in Guidelines 02/2025: "after deletion of the secret key or salt, the hash should not be linkable to the original data". Note the EDPB's caveat that while the salt exists the hash is still personal data; after erasure it is not. actor and target are header fields and are not erasable without breaking the chain, so use opaque identifiers (user ids, not emails) if your subjects may ask for erasure.
Where data lives
[OWNER: fill — VPS region, EU or US]. One SQLite database file per project on a server we rent; backups are file copies on the same provider. Sub-processors: Stripe (billing), the email provider for magic links [OWNER: name it], the hosting provider [OWNER: name it], Sigstore Rekor and OpenTimestamps calendar servers (receive root hashes only).
Who can see your data
You and the members of your project; anyone you give a viewer token; an operator of this service with database access, within the limits described in the threat model. We do not sell data, run advertising, or use your events for anything but serving them back to you.
Your rights
Access, export (the export API gives you everything in a verifiable file), correction of account details, erasure of your account and projects (file delete), and complaint to your supervisory authority. Email support@auditkit.dev; we answer within 30 days. [OWNER: confirm the 30-day response commitment]
Changes
We will update the date at the top and, for material changes, email account holders.