Privacy Policy
This policy describes what personal data Secrevo collects, why we collect it, who we share it with, and the rights you have over it. We try to keep it short and accurate. If anything below is unclear, write to [email protected].
1. Who we are
Secrevo is operated by Ganemo (the legal entity behind getsecrevo.com and secrevo.com). When this document says "we", "us" or "Secrevo", it refers to that entity.
2. What we collect
2.1 Account data
When you sign in we receive your name and email from our identity provider (PrysmID). We use this to identify you inside your workspace, send transactional email (invitations, billing receipts, security notices), and gate access to the API and dashboard.
2.2 Workspace data
Inside your workspace we store secret metadata (names, descriptions, tags) and an audit trail of every action (who reveals what, when, from where). We never log secret values to our application logs or audit trail.
2.3 Secret values
Secret values you store in Secrevo are encrypted at rest in our managed OpenBao instance, scoped to a per-workspace namespace, and only released over an authenticated session. Operators of Secrevo cannot read your secret values without leaving an audit footprint that you can see in your own audit log.
2.4 Billing data
Plan, billing email, subscription status and Stripe customer/subscription IDs are stored by us. Card numbers are never sent to or stored by Secrevo — they live exclusively with Stripe (PCI DSS Level 1 service provider).
2.5 Operational data
HTTP request logs (path, status, latency, source IP, user agent, request ID) are kept in CloudWatch for 30 days for the API and 90 days for OpenBao. Beyond that they are dropped.
3. What we don't do
- We do not sell your data. There is no advertising network behind Secrevo.
- We do not train machine-learning models on your secrets, secret metadata, or audit trail.
- We do not embed third-party trackers, analytics tags, or social pixels on the dashboard or marketing site beyond what is strictly required to render the page.
4. Sub-processors
Secrevo relies on a small set of vendors to operate the service. The current list:
- Amazon Web Services — compute, storage, KMS, RDS Postgres, CloudWatch (region:
us-east-1). - Cloudflare — DNS, CDN, edge TLS for the marketing site and dashboard.
- Stripe — billing, payment processing, customer portal.
- PrysmID — identity provider (sign-in, account management).
- Emboux — transactional email relay (invitations, notifications).
We update this list when it changes. Customers on a signed Data Processing Agreement (see DPA) are notified before a sub-processor change takes effect.
5. Retention
- Account and workspace data are kept while your account is active and for 30 days after deletion, after which they are removed from the primary database.
- Encrypted backups are kept for 30 days and then rotated out.
- Audit logs are kept per the retention window of your plan (7, 30, 90 days, or 1 year for Enterprise).
- Stripe billing records are retained as required by tax law in the seller's jurisdiction.
6. Your rights
If you are in the EU, UK, Switzerland, or another jurisdiction with a similar privacy regime, you have the right to access, correct, export, and delete the personal data we hold about you. Email [email protected] from the address associated with your account and we will respond within 30 days.
For deletion: most of your data is reachable from the dashboard already (/members, /secrets, /audit). For full account deletion we need an explicit request because deletion is irreversible.
7. Security
See the Security overview for the technical details. The short version: secrets are encrypted at rest with AWS KMS, in transit with TLS 1.3, isolated per workspace, and access requires an authenticated session that leaves an audit trail.
8. International transfers
Production data is stored in AWS us-east-1. If your team is in the EU/UK and this is a problem for your compliance posture, write to [email protected] — we can discuss EU residency on enterprise plans.
9. Children
Secrevo is a B2B product not intended for individuals under 16. We do not knowingly collect data from minors.
10. Changes
We will update this page when our practices change and revise the "last updated" date at the top. Material changes will also be announced by email to the workspace billing contact.
Questions about this document — or a request for a signed copy — go to [email protected]. Security disclosures: [email protected].