Who we are
Keylayer is run by Bitgate, Inc. We decide how the data on this page is used, which makes us its controller under the GDPR.
This policy covers keylayer.io, the dashboard at keylayer.app, and the Keylayer API and relay.
Signing in
You sign in with Google, through Firebase Authentication. We ask Google only for your email address and your account ID, not your name or photo, and we only accept an email address Google has verified.
For each account we keep one workspace record: your Google account ID, your Firebase user ID, your email address, your plan, the date you signed up and the time you last signed out everywhere. Firebase keeps its own record of your account ID and email address.
You need to be at least 16 to use Keylayer.
Cookies and browser storage
Keylayer sets no cookies of its own, on the site, the dashboard or the API.
The dashboard keeps you signed in through Firebase, which stores your sign-in in your browser's IndexedDB. While you use the dashboard, it keeps short-lived state, such as where to return after signing in and the settings of a key you're still creating, in session storage, which your browser clears when you close the tab.
If you add a browser as a way to unlock your vault, the vault page at vault.keylayer.dev stores a device secret in that browser's IndexedDB. Clearing your browser data removes it.
Your provider keys
You add a provider API key in the vault window, a separate page at vault.keylayer.dev, so the dashboard never sees it. Our API encrypts it with AES-256-GCM before storing it, and no screen or API shows it again.
The key that decrypts it is locked with a secret that exists only inside the Keylayer keys you issue. We store your Keylayer keys only as hashes, apart from the copies your vault keeps encrypted, and your vault opens only with your passkey, your recovery code or a browser you linked. So the data we store can't decrypt your provider key on its own.
When a request arrives with a valid Keylayer key, the relay uses it to decrypt your provider key in memory, adds it to the request to your provider and discards it once the request is sent. It is never written to disk or to logs in readable form.
Keylayer is not end-to-end encrypted and not zero-knowledge. Our relay reads your provider key every time it forwards a request for you. That is how it can call your provider on your behalf.
Cloudflare stores each encrypted provider key in its own Durable Object, which we ask Cloudflare to place in the region you picked for it, or near where you added it. When you revoke a credential, we erase its encrypted key. Cloudflare's storage history can keep earlier copies of the encrypted data for up to 30 days.
Requests you send through Keylayer
The relay forwards each request to your provider and streams the answer back. We never store request or response bodies, so no prompts, completions or files. To enforce a spend cap or catch a leaked provider key, the relay may read a request or an answer in memory while it passes through, and keeps only the counts below.
For each request, your activity log records the Keylayer key and credential used, the provider, the path without its query string, the names of any query parameters but not their values, your IP address, your user agent (up to 128 characters), the time, whether the request was allowed and why, the status code, token counts, the cost Keylayer counted and the request and answer sizes. It also records changes to your credentials and keys, such as their names, limits and allowed hosts.
Your provider gets your request with your provider key added. The relay removes your IP address, cookies and forwarding headers, so the request reaches your provider from Cloudflare's network. Your user agent and other ordinary headers pass through.
The providers you add, such as OpenAI, Anthropic or Google, receive your requests under your own account with them. What a provider does with them is covered by your agreement with that provider and its privacy policy, not by this one.
Emails
We email the address on your workspace when something changes in your vault, such as a passkey added or removed, a recovery code used or replaced, a browser linked, a vault reset or a key delivery left unfinished, and once a week while your vault has no passkey. These emails can include the time, your workspace ID and the IP address and city of the request behind them. They never contain links or codes.
We also email you before changes to your plan's price or to these policies take effect. Postmark sends our emails, with open and link tracking turned off.
Payments
If you buy a paid plan, Stripe handles the payment through Stripe Managed Payments and is the merchant of record for the sale. Your card and billing details go straight to Stripe, and Keylayer never sees or stores card numbers. We keep your plan, subscription status and renewal date with your workspace. Bitgate's billing service at payments.bitgate.com keeps the Stripe customer and subscription records.
Analytics
On keylayer.io we count visits with ClickTag, cookieless analytics made by Bitgate. It records the page address, the site you came from, your browser, operating system and device type, screen size, language and time zone. It sets no cookies and stores nothing in your browser. Your IP address only goes into a visitor hash that changes every day, and is never stored. It respects Do Not Track, and stores its data in Frankfurt, Germany. The dashboard has no analytics.
Who processes your data
- Cloudflare runs the site, the dashboard, the API and the relay. It stores your encrypted provider keys, activity records on their way to our database and short-lived rate limit counters, some keyed by IP address. Its operational metrics hold no IP address or user agent and are kept for 3 months. For keylayer.io and keylayer.app, Cloudflare also keeps technical logs for up to 7 days, such as the address requested, your browser, network details that can include your IP address, and account IDs, without sign-in tokens. Logging is off for the API, the relay and the vault page.
- OVHcloud hosts our Postgres database in the EU, with your workspace record, activity log, usage totals and the emails we queue.
- Google runs Google sign-in and Firebase Authentication.
- Postmark sends our emails.
- Stripe processes payments for paid plans.
Some of these companies are based in the United States. Where data leaves the EU, we rely on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. We don't sell your data, and we don't use it for advertising.
Why we use your data
- To run Keylayer for you: signing you in, storing and using your provider keys, relaying requests, enforcing your limits, showing your activity and sending security emails (performance of a contract).
- To keep Keylayer secure and working: rate limits, abuse prevention, which can block a workspace or an email domain, debugging and counting visits to the site (legitimate interest).
- To keep the records the law requires and answer lawful requests (legal obligation).
How long we keep it
- Activity records: 7 days on the free plan, 90 days on paid plans.
- Records of Keylayer keys: 7 days after they expire on the free plan and 90 days on paid plans. Revoked keys: 30 days on the free plan, 90 days on paid plans.
- Vault events, daily usage per key and the emails we queued: 90 days. Daily usage per workspace: 180 days.
- The short-lived approvals the dashboard signs for key and vault actions: 24 hours.
- Activity records that fail to import: until we fix and import them, then 90 days.
- Your workspace record, the list of your credentials (IDs and dates, never the key itself) and your vault's state: until you ask us to delete your account.
Deletion runs every minute, but pauses for a workspace while we repair its records that failed to import.
Your rights
You can ask to see, correct, export or delete your data, and object to or restrict how we use it. Email bart@bitgate.com from the address on your workspace, and we'll answer within 30 days. The dashboard has no button to export your data or delete your account, so we handle these requests by hand. You can revoke your credentials and keys in the dashboard at any time.
When we delete your account, we remove your workspace, credentials, keys and activity records. Copies in backups and in Cloudflare's storage history expire on their own schedule.
You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority where you live.
Changes to this policy
When this policy changes, we update the date at the top. For changes that matter, we email you before they take effect.
Contact
Questions about this policy or your data, and reports of a security issue, go to bart@bitgate.com. Our terms of service cover the rest.