05 / TRUST
Trust & security
These facts hold the same on day 0, solo, as they do the day your company hires its fiftieth person and hands Team the keys: no trackers, no unlisted card searchable by anyone but the person you gave it to, and a revoke button that actually works the moment you need it.
No trackers
No third-party analytics or tracking scripts are loaded on this site or on published cards. Session state (like signup attribution) is kept in sessionStorage only, never sent to a third party.
No passwords
There are no passwords on this service. You sign in with a link we email you, or with Google or Microsoft. There is no password database here to breach, and nothing for you to reuse elsewhere.
Cards are unlisted
Cards are unlisted and marked no-index. Only someone with the link — or the card in hand — can open one; they never appear in search results.
Revoke in a second
On Team, one click stops the link, the QR, and the NFC chip a revoked card used — globally, not eventually.
Where your data lives
Hosted on Cloudflare and Neon (our database provider), both US infrastructure. Traffic is encrypted in transit throughout; data at rest is encrypted (AES-256) by Cloudflare and Neon. Directory sync (when enabled) talks to Microsoft 365 over its own API — Google is on the roadmap. We never store your directory password.
What's next
SOC 2 is on the roadmap, not complete yet — this page will say so plainly the day it is. SSO/SCIM: magic link, Google, and Microsoft sign-in work today; SAML/SCIM are on the roadmap.
Reporting a vulnerability
Email hello@kepptic.io. Tell us what you found and how to reproduce it. Do not access anyone else’s data, degrade the service or hold a finding for payment. We will acknowledge you within 3 business days, keep you posted, and we will not pursue anyone who reports in good faith and follows this. We do not pay rewards today.
Contact
Security or privacy questions: hello@kepptic.io.
Full detail: Privacy Policy · Terms of Service · Data Processing Agreement