Privacy Policy
Last updated: May 14, 2026 · Effective: May 14, 2026
SummitFlux LLC ("SummitFlux," "we," "us," or "our") operates Keep, a backend-as-a-service platform. This Privacy Policy explains how we collect, use, share, and protect information when you use Keep.
1. Scope and Deployment Models
Self-hosted Keep: If you run Keep on your own infrastructure, SummitFlux is not in the data path. You are the data controller. This Privacy Policy applies only to your use of keep.bastionary.com managed services and the Keep website.
Managed Keep: When you use the hosted service at keep.bastionary.com, SummitFlux acts as a data processor on your behalf. You remain the data controller for the data your application stores in Keep.
2. Information We Collect
Account information: Keep authentication is handled entirely by Bastionary. When you authenticate, Keep receives your Bastionary JWT (user ID, tenant ID, license tier). Keep does not store credentials.
Customer data: Data your application stores via the Keep API — objects, sync deltas, database rows, search index documents, and audit events — is stored on your behalf. We are a data processor for this content.
Usage and operational data: API call logs, error events, and performance metrics are collected to operate and improve the service. Prometheus metrics are token-gated and not shared externally.
Audit chain: HMAC-SHA256 chained event records (actor, action, target, timestamp, hash) are stored for tamper-detection purposes. Retention is configurable per tenant.
3. How We Use Information
- To provide, operate, and improve Keep services
- To enforce license quotas and detect abuse
- To detect and respond to security incidents
- To comply with legal obligations
We do not sell your data. We do not use customer data to train AI models or serve advertisements.
4. Data Sharing
We share data with:
- Infrastructure providers: Hetzner (hosting), Cloudflare (DNS/DDoS) — under data processing agreements
- Bastionary: License validation and session revocation require communication with Bastionary's API. No customer data is transferred; only tenant ID and license tier are exchanged.
- Legal requirements: When required by law, court order, or to protect rights
5. Data Retention
Operational logs are retained for 90 days. Audit chain records are retained indefinitely by default; per-tenant retention policies are configurable. Soft-deleted data is purged after a 7-day grace period. Backups are retained on a 30-day rolling basis.
To request early deletion of your tenant data, contact [email protected].
6. Your Rights
Depending on your location, you may have the right to access, correct, delete, or export your personal data. To exercise these rights, contact [email protected]. We will respond within 30 days.
EU/EEA customers: Keep processes data under Standard Contractual Clauses. A Data Processing Addendum (DPA) is available on request.
7. Security
We implement TLS in transit, encryption at rest for sensitive fields, parameterized queries to prevent injection, rate limiting (200 req/min per authenticated user), and regular security reviews. See our Security page for details on the shared security posture.
8. Colorado Privacy
SummitFlux LLC is headquartered in Colorado, USA. Colorado residents have rights under the Colorado Privacy Act (CPA), including the right to access, correct, delete, and opt out of certain data processing. To exercise these rights, contact [email protected].
9. Changes to This Policy
We will notify you of material changes by email at least 30 days before they take effect. The "last updated" date at the top reflects the most recent revision.
10. Contact
Privacy questions: [email protected]. For GDPR-specific requests, include "GDPR Request" in the subject line. For DSAR or DPA requests, include "DSAR" or "DPA Request" accordingly.