What we collect
- Your account: your name, email address and profile picture from your Google or GitHub sign-in, the workspaces you belong to and your role in each.
- Messages to us: what you send through the contact page (your name, email address, message, and the app or company you name) reaches our inbox by email, and is kept only as long as the conversation needs it.
- Your apps: their addresses, the attack results (findings with redacted proof, coverage, history), and settings such as alert addresses or Slack webhooks.
- Code audit records: when your coding agent audits your code and sends its findings, we keep those records: titles, file paths, line numbers, short excerpts and the suggested fix. Your code itself stays on your machine.
- Credentials you give us: test-account passwords, session headers and discovery tokens, encrypted with AES-256-GCM. API keys and session tokens are stored only as hashes.
- Billing: your plan and Polar customer reference. Card details go to Polar, never to us.
- Usage: when you last used Keybrum, and the browser of each signed-in session, so you can recognise them.
- Product analytics: the pages you open and the buttons you use on keybrum.com, and the steps your account takes (signed up, added an app, proved it, paid, ran an attack, closed a finding). These events carry Keybrum's own ids, your email once you are signed in, and never your apps' data or what an attack found. See analytics and consent.
Personal data of your app's users
When an attack proves that strangers can read personal data in your app, we act on your behalf: we keep at most one redacted example per finding (emails, phone numbers, names and tokens masked) plus counts and column names, and nothing else. File contents are never stored. If you need a data processing agreement, write to us.
Why we use it
- To run the service you signed up for: attacks, reports, alerts, billing (performance of our contract).
- To keep Keybrum safe: prevent abuse, investigate reports, secure accounts (our legitimate interest).
- To improve the attack library with anonymized, aggregated statistics that never identify an app or a person (our legitimate interest).
- To see where people get stuck between finding Keybrum and fixing their first leak, through product analytics: with your consent for the analytics cookie, and our legitimate interest for counts that store nothing on your device and for the steps of your account.
- To keep invoices and accounting records (legal obligation).
We don't sell personal data and don't use it for advertising.
Cookies
Two cookies are needed for Keybrum to work, and are always set:
kb_sessionkeeps you signed in, for up to 30 days.kb_oauthties a Google or GitHub sign-in to your browser, for 10 minutes.
One is set only if you accept it:
ph_…_posthog, from PostHog, links your visits together for product analytics, for up to a year.
Your cookie choice is kept in your browser's local storage, so we don't ask again. There is no advertising cookie and no tracking across other sites. Change your choice any time with .
Analytics and consent
Keybrum uses PostHog, hosted in the European Union (Frankfurt), to understand how the site and the product are used. Visitors from the EU, the EEA, the United Kingdom and Switzerland are asked first. Until you accept, and whenever you decline, nothing is stored on your device: visits are counted with a hash of your IP address and browser that PostHog computes on its servers and that changes every day, so they cannot be linked from one day to the next. Accepting lets PostHog's cookie link your visits, and, once you are signed in, link them to your account.
The steps your account takes (signed up, added an app, proved it, paid, ran an attack, closed a finding, wrote to us) are recorded by our server whatever your cookie choice, because they describe your use of the service rather than your browser. To object to that, write to [email protected].
Who helps us
- Google and GitHub, for sign-in.
- Polar, for payments, invoices and VAT.
- PostHog (EU cloud, Frankfurt), for product analytics.
- Resend, to send your account confirmation, invitations, report notices, reminders, the weekly summary, and the messages you write us through the contact page.
- Cloudflare, to receive the confirmation emails of Keybrum's own throwaway test accounts.
- Our hosting and database providers.
Some of them process data outside the European Union. Those transfers rely on an adequacy decision or the European Commission's standard contractual clauses.
How long we keep it
- Your account, until you delete it from your account page.
- Apps, findings and history, until you delete the app or its workspace.
- The live feed of each attack run, 7 days.
- Product analytics events, for the retention period of our PostHog plan, or until you ask us to delete yours.
- Confirmation emails received by Keybrum's test accounts, 10 minutes.
- Invoices, as long as tax law requires.
Your rights
You can access, correct, export or delete your personal data, object to its use or ask us to restrict it. Most of it is on your account page, where you can also delete your account. For anything else, write to [email protected]; we answer within a month. You can also complain to your data protection authority.
How the attacks themselves handle data is on the security page.