TRUST
Trust center
Last updated October 17, 2026
The short answers to a security questionnaire, with links to the documents behind them. If your review needs more, write to security@keanan.app and we fill in your questionnaire once.
At a glance
| Hosting | Amazon Web Services, Frankfurt region (EU). Managed customers choose their region. Self hosted customers run everything on their own infrastructure. |
| Data ownership | The customer is the controller. A one click export packs every record and file into one archive, and the same archive restores on your own servers. |
| Encryption | TLS on every connection, with HSTS. Certificates are issued and renewed automatically. |
| Sign in | Short lived tokens with rotating refresh tokens. Optional or enforced two factor codes, and single sign-on with Google Workspace or Microsoft 365. |
| Access control | Admin, manager and employee roles checked on every endpoint. Managers only see and approve requests from their own reporting line. |
| Audit trail | Every administrative change is recorded with who, what and when. Exports are always logged. |
| Backups | Nightly database and file backups, fourteen copies kept, with an offsite copy in object storage. |
| Availability | 99.5 percent monthly uptime for hosted workspaces with service credits, and a public status page with incident history. |
| Isolation | Each customer gets its own database and its own application stack. Nothing is shared between workspaces at the data layer. |
| Mobile app | Biometric lock that relocks in the background. The app talks only to the customer's own workspace. |
Subprocessors
| Subprocessor | Purpose | Location |
|---|---|---|
| Amazon Web Services EMEA SARL | Hosting of workspaces and backups | EU, Frankfurt |
| Resend, Inc. | Transactional email | USA, under EU standard contractual clauses |
We announce changes at least 30 days ahead, as set out in the data processing agreement. Payments run through Whop as merchant of record; no workspace data is shared with it.
Documents
- Security practices, including how to report a vulnerability
- Data processing agreement (Art. 28 GDPR), countersigned copy from legal@keanan.app
- Service level agreement
- Privacy policy
- Terms of service
- How employees request account deletion
- Self hosting guide and migration guide
What we do not have yet
Keanan is not SOC 2 or ISO 27001 certified. Customers who need those controls run Keanan on their own audited infrastructure with the self hosted license, where the security boundary is theirs.