Business access is checked on the server
Operational requests are scoped to the signed-in user’s business and permitted role. Independent accounts use Supabase authentication. The private platform-admin portal has a separate owner allowlist and authenticator verification; being a customer’s Owner does not grant platform-admin access. Customer operational access requires verified credentials and an active subscription or card-backed trial. Missing subscription records, sandbox payments and expired trials cannot unlock customer business data; separately authorised platform-owner testing is not a customer billing bypass.
Files and exports
File access is checked against business membership. Uploads have type, size and storage-quota checks. CSV exports and owner backup downloads are available. Encrypted production R2 EU backup data was restored to an isolated SQLite database on 11 October 2026 (19 tables and 19 records). A separate synthetic attachment round trip restored one file with its hash verified. Backup health reported complete at 16:32 UTC with restore verification recorded, 35-day retention and expiry enabled. The daily 02:00 UTC schedule is enabled; no future scheduled run or full hosted disaster recovery is claimed.
What is not claimed
Keepalto does not claim SOC 2 certification, ISO 27001 certification, a contractual uptime guarantee, UK-only hosting, enterprise SSO or an independent penetration test. File quotas and private access do not replace malware screening or your own equipment-safety checks.
Report a concern
Email support@keepalto.com with ‘Keepalto security’ in the subject and include the affected page, time and a minimal description. Do not send passwords, access tokens or other people’s records. Do not test against other businesses’ data. There is no advertised round-the-clock response SLA or bug-bounty programme. The standard security.txt file publishes the same contact and this policy location.