Privacy Policy

1. Who we are

Secrevo is operated by Ganemo (the legal entity behind getsecrevo.com and secrevo.com). When this document says "we", "us" or "Secrevo", it refers to that entity.

2. What we collect

2.1 Account data

When you sign in we receive your name and email from our identity provider (PrysmID). We use this to identify you inside your workspace, send transactional email (invitations, billing receipts, security notices), and gate access to the API and dashboard.

2.2 Workspace data

Inside your workspace we store secret metadata (names, descriptions, tags) and an audit trail of every action (who reveals what, when, from where). We never log secret values to our application logs or audit trail.

2.3 Secret values

Secret values you store in Secrevo are encrypted at rest in our managed OpenBao instance, scoped to a per-workspace namespace, and only released over an authenticated session. Operators of Secrevo cannot read your secret values without leaving an audit footprint that you can see in your own audit log.

2.4 Billing data

Plan, billing email, subscription status and Stripe customer/subscription IDs are stored by us. Card numbers are never sent to or stored by Secrevo — they live exclusively with Stripe (PCI DSS Level 1 service provider).

2.5 Operational data

HTTP request logs (path, status, latency, source IP, user agent, request ID) are kept in CloudWatch for 30 days for the API and 90 days for OpenBao. Beyond that they are dropped.

3. What we don't do

• We do not sell your data. There is no advertising network behind Secrevo.
• We do not train machine-learning models on your secrets, secret metadata, or audit trail.
• We do not embed third-party trackers, analytics tags, or social pixels on the dashboard or marketing site beyond what is strictly required to render the page.

4. Sub-processors

Secrevo relies on a small set of vendors to operate the service. The current list:

• Amazon Web Services — compute, storage, KMS, RDS Postgres, CloudWatch (region: us-east-1).
• Cloudflare — DNS, CDN, edge TLS for the marketing site and dashboard.
• Stripe — billing, payment processing, customer portal.
• PrysmID — identity provider (sign-in, account management).
• Emboux — transactional email relay (invitations, notifications).

We update this list when it changes. Customers on a signed Data Processing Agreement (see DPA) are notified before a sub-processor change takes effect.

5. Retention

• Account and workspace data are kept while your account is active and for 30 days after deletion, after which they are removed from the primary database.
• Encrypted backups are kept for 30 days and then rotated out.
• Audit logs are kept per the retention window of your plan (7, 30, 90 days, or 1 year for Enterprise).
• Stripe billing records are retained as required by tax law in the seller's jurisdiction.

6. Your rights

If you are in the EU, UK, Switzerland, or another jurisdiction with a similar privacy regime, you have the right to access, correct, export, and delete the personal data we hold about you. Email [email protected] from the address associated with your account and we will respond within 30 days.

For deletion: most of your data is reachable from the dashboard already (/members, /secrets, /audit). For full account deletion we need an explicit request because deletion is irreversible.

7. Security

See the Security overview for the technical details. The short version: secrets are encrypted at rest with AWS KMS, in transit with TLS 1.3, isolated per workspace, and access requires an authenticated session that leaves an audit trail.

8. International transfers

Production data is stored in AWS us-east-1. If your team is in the EU/UK and this is a problem for your compliance posture, write to [email protected] — we can discuss EU residency on enterprise plans.

9. Children

Secrevo is a B2B product not intended for individuals under 16. We do not knowingly collect data from minors.

10. Changes

We will update this page when our practices change and revise the "last updated" date at the top. Material changes will also be announced by email to the workspace billing contact.