Keydris

Legal document

Keydris Privacy Policy

Effective August 10, 2026

Keydris, Inc. (“Keydris,” “we,” “us,” or “our”) provides authorization control-plane infrastructure intended to help organizations and systems establish, issue, manage, verify, and revoke delegated authority for AI agents, applications, services, and other systems.

This Privacy Policy explains how Keydris may collect, use, disclose, retain, and otherwise process personal information when individuals interact with Keydris websites, accounts, APIs, SDKs, software, integrations, support channels, and other services that reference this Policy (collectively, the “Services”).

Keydris primarily provides Services to businesses and organizations.

1. Scope

This Privacy Policy applies when you:

  • visit a Keydris website;
  • create or administer a Keydris account;
  • use the Services on behalf of an organization;
  • interact with a Keydris API, SDK, dashboard, or integration;
  • request a demo, trial, evaluation, or other business interaction;
  • contact Keydris;
  • request support; or
  • otherwise provide personal information to Keydris in connection with the Services.

This Policy describes Keydris’s own handling of personal information.

Organizations using Keydris remain responsible for their own privacy practices, systems, agents, users, instructions, and legal obligations.

Where Keydris processes personal information on behalf of a customer, the applicable customer agreement and any applicable data-processing terms may govern that processing.

Third-party applications, APIs, platforms, models, websites, and other services connected to Keydris maintain their own privacy practices.

2. Authorization Control Plane and Data Boundary

Keydris is designed to operate as authorization control-plane infrastructure.

The Customer’s underlying application traffic, payment, transaction, API operation, MCP tool execution, database operation, deployment, communication, or other underlying action does not need to be routed through Keydris merely because Keydris authorization functionality is used.

Keydris does not become the Customer’s underlying execution or data plane merely by providing the Services.

However, an authorization control plane requires certain information to operate.

Depending on the Services used, Keydris may process information such as:

  • identifiers;
  • organization or system context;
  • authority grants;
  • scopes;
  • permissions;
  • policies;
  • limits;
  • conditions;
  • approval information;
  • expiration information;
  • revocation information;
  • verification information;
  • timestamps;
  • account information;
  • configuration information; and
  • related technical and operational records.

The separation between Keydris’s authorization control plane and a Customer’s underlying execution or data plane does not mean that Keydris processes no information.

Keydris is designed to minimize processing of underlying customer-action information and to process authorization-related and operational information reasonably necessary to provide the Services.

Customers should configure integrations so that information unnecessary to an authorization decision is not transmitted to Keydris.

3. Personal Information We May Process

The information Keydris processes depends on your relationship with Keydris and how the Services are used.

A. Business and Account Information

We may process information such as:

  • name;
  • work email address;
  • organization;
  • job title;
  • professional role;
  • account identifiers;
  • administrator status;
  • account preferences;
  • authentication-related information;
  • trial or evaluation information; and
  • commercial relationship information.

B. Communications and Support Information

If you communicate with Keydris, we may process:

  • emails;
  • support requests;
  • questions;
  • feedback;
  • correspondence;
  • attachments; and
  • other information you choose to provide.

Do not send passwords, private keys, signing keys, payment credentials, access tokens, or other secrets through general support or communication channels unless Keydris specifically requests them through a channel designed for that purpose.

C. Technical, Usage, and Security Information

When you access a Keydris website or Service, Keydris and its service providers may process technical and operational information such as:

  • IP address;
  • browser information;
  • device information;
  • operating system;
  • timestamps;
  • session identifiers;
  • request identifiers;
  • API activity;
  • integration activity;
  • pages or features accessed;
  • diagnostic information;
  • error information; and
  • security-related events.

D. Authorization-Related Information

When an organization uses Keydris, the Services may process information necessary to establish, issue, manage, verify, enforce, record, or revoke delegated authority.

Depending on the applicable functionality, this may include:

  • agent, system, user, or organization identifiers;
  • authority grants;
  • scopes;
  • permissions;
  • policies;
  • operational or transaction limits;
  • conditions;
  • approval information;
  • expiration information;
  • revocation status;
  • verification results;
  • timestamps;
  • authorization configuration; and
  • related authorization records.

Authorization information may constitute personal information where it identifies or relates to an individual.

E. Information from Customers and Integrations

Keydris may receive relevant information from:

  • organizations that authorize individuals to use Keydris;
  • authorized administrators;
  • Customer-enabled integrations;
  • APIs;
  • SDKs;
  • service providers acting on Keydris’s behalf; and
  • other sources involved in a legitimate business relationship with Keydris.

4. Information Customers Should Not Submit

Unless a Keydris Service is specifically designed and documented to receive such information, customers should not submit:

  • passwords;
  • private keys;
  • signing keys;
  • payment-card credentials;
  • unnecessary API credentials;
  • unnecessary secrets;
  • unnecessary sensitive personal information; or
  • information unrelated to the authorization purpose for which Keydris is being used.

Customers are responsible for determining what information is appropriate to provide through their implementations.

5. How We Use Personal Information

Keydris may use personal information to:

  • provide and operate the Services;
  • create and administer accounts;
  • authenticate users and administrators;
  • establish and manage delegated authority;
  • issue, manage, verify, and revoke authorization information;
  • evaluate authorization policies, limits, and conditions;
  • maintain authorization and operational records;
  • provide APIs, SDKs, and integrations;
  • troubleshoot technical issues;
  • respond to support requests and communications;
  • monitor and maintain Service reliability and performance;
  • secure accounts, systems, and Services;
  • detect, investigate, and prevent fraud, misuse, abuse, unauthorized access, and security threats;
  • investigate violations of applicable terms;
  • develop, maintain, and improve the Services and Keydris operations;
  • administer trials, evaluations, Orders, billing, and customer relationships;
  • send operational, security, administrative, and legal communications;
  • send business or product communications where permitted by applicable law;
  • comply with legal obligations;
  • respond to lawful requests;
  • establish, exercise, or defend legal claims;
  • enforce agreements; and
  • protect the rights, safety, and property of Keydris, customers, users, and others.

Where Keydris processes Customer Data on behalf of a customer, Keydris processes that information as reasonably necessary to provide, maintain, secure, troubleshoot, and support the Services and otherwise according to the applicable customer relationship.

Keydris may use aggregated or de-identified information that does not reasonably identify an individual or Customer for security, analytics, development, and operational purposes.

6. AI Agents and Customer Responsibilities

Customers determine the agents, applications, users, systems, permissions, policies, limits, instructions, and underlying actions associated with their use of Keydris.

Customers are responsible for:

  • determining whether they may lawfully provide or direct Keydris to process personal information;
  • providing required privacy notices;
  • obtaining required permissions, consents, or other legal bases;
  • configuring their implementation appropriately;
  • maintaining appropriate access controls;
  • limiting information submitted to what is reasonably necessary; and
  • ensuring their agents, applications, and systems do not submit unauthorized or unnecessary information.

Keydris does not independently determine whether an underlying agent action is lawful, appropriate, accurate, safe, or commercially desirable.

Authorization information provided through Keydris does not replace Customer’s own governance, security controls, access controls, compliance obligations, legal review, or human oversight.

7. How We May Disclose Personal Information

Keydris may disclose personal information in the following circumstances.

A. Service Providers and Professional Advisers

Keydris may engage service providers and professional advisers that support functions such as:

  • cloud infrastructure;
  • hosting;
  • communications;
  • authentication;
  • customer support;
  • security;
  • monitoring and diagnostics;
  • analytics;
  • billing;
  • legal services;
  • accounting; and
  • other business operations.

These recipients may process information as reasonably necessary to provide their services to Keydris and subject to applicable contractual or legal obligations.

B. Customer Organizations

If you use Keydris through an organization, relevant account, configuration, authorization, support, security, administrative, and usage information may be made available to authorized administrators or users of that organization.

C. Customer-Enabled Integrations

If Customer enables an integration or instructs Keydris to interact with a third-party service, information may be exchanged with that service as reasonably necessary to provide the requested functionality.

Third parties have their own privacy practices, and their independent processing is governed by their own terms and privacy policies.

D. Legal, Security, and Safety Purposes

Keydris may preserve, use, or disclose information where reasonably necessary to:

  • comply with applicable law;
  • respond to valid legal process;
  • respond to enforceable governmental requests;
  • investigate fraud, abuse, or unauthorized use;
  • investigate or respond to security incidents;
  • enforce agreements;
  • protect Keydris’s legal rights or property;
  • protect the Services; or
  • protect customers, users, or others.

E. Corporate Transactions

Information may be disclosed or transferred in connection with a proposed or completed:

  • financing;
  • investment;
  • merger;
  • acquisition;
  • corporate restructuring;
  • reorganization;
  • bankruptcy;
  • sale of assets; or
  • similar corporate transaction.

Where appropriate, information will remain subject to applicable confidentiality and legal protections.

8. Advertising and Sale of Personal Information

Keydris is a B2B authorization-infrastructure provider.

Keydris does not operate an advertising network.

Keydris does not disclose personal information to third parties solely in exchange for monetary consideration.

If Keydris’s practices materially change in the future in a manner requiring additional disclosures, choices, or consent under applicable law, Keydris will update its practices and this Privacy Policy as appropriate.

9. Controller and Processor Roles

Keydris’s privacy role depends on the particular processing activity.

Keydris may determine the purposes and means of processing certain information associated with its own:

  • website operations;
  • account administration;
  • business relationships;
  • security operations;
  • communications;
  • support operations;
  • product operations; and
  • legal compliance.

For those activities, Keydris may act as a controller, business, or similar role under applicable privacy law.

Where Keydris processes Customer Data solely on behalf of a customer to provide the Services according to that customer’s instructions, Keydris may act as a processor, service provider, or similar role.

The applicable customer agreement, any applicable Data Processing Addendum, and the specific processing activity determine the parties’ respective responsibilities.

10. Cookies and Similar Technologies

Keydris websites and Services may use cookies, local storage, or similar technologies for functions such as:

  • website functionality;
  • account functionality;
  • authentication;
  • security;
  • user preferences;
  • Service operation; and
  • performance measurement.

Keydris may use analytics technologies to understand website or Service performance and usage.

Where applicable law requires notice, consent, or choices for non-essential technologies, Keydris will provide those mechanisms as required.

Browser and device settings may provide additional controls over certain technologies.

11. Retention and Deletion

Keydris retains personal information for as long as reasonably necessary for the purposes described in this Privacy Policy.

Retention periods may vary depending on:

  • the type of information;
  • the applicable Service;
  • the duration of the customer relationship;
  • authorization-record requirements;
  • audit or security requirements;
  • operational requirements;
  • contractual obligations;
  • dispute-resolution needs;
  • fraud-prevention needs; and
  • applicable legal obligations.

When information is no longer reasonably necessary, Keydris may delete, anonymize, aggregate, or otherwise dispose of it.

Information may remain for a limited period in backups or similar systems after deletion from active systems.

Keydris may retain information where reasonably necessary to:

  • comply with applicable law;
  • comply with a legal hold;
  • investigate security incidents;
  • prevent fraud or abuse;
  • resolve disputes;
  • enforce agreements; or
  • establish, exercise, or defend legal claims.

Closing an account does not necessarily require immediate deletion of every record where continued retention is reasonably necessary for these purposes.

12. Security

Keydris uses reasonable administrative, technical, and organizational measures designed to protect information against unauthorized access, loss, misuse, alteration, or disclosure.

No internet transmission, software platform, network, or electronic storage system can be guaranteed to be completely secure.

Customers remain responsible for protecting their own:

  • systems;
  • agents;
  • applications;
  • accounts;
  • credentials;
  • integrations;
  • endpoints;
  • policies; and
  • configurations.

If you believe you have identified:

  • a vulnerability;
  • unauthorized access;
  • account compromise;
  • misuse of Keydris; or
  • another security concern involving the Services,
  • contact:
  • security@keydris.com

13. International Processing and Transfers

Keydris and service providers supporting the Services may process information in countries different from the country where an individual resides or Customer operates.

Privacy and data-protection laws may differ between jurisdictions.

Where applicable law requires particular safeguards or mechanisms for international transfers of personal information, Keydris will use measures appropriate to the applicable processing.

14. Privacy Rights and Choices

Depending on your location and applicable law, you may have rights concerning your personal information.

These may include rights to request:

  • access to certain personal information;
  • correction of inaccurate information;
  • deletion of certain information;
  • a copy of certain information;
  • restriction of certain processing; or
  • objection to certain processing.

Where processing is based on consent, you may have the right to withdraw consent.

These rights are not absolute and may be subject to applicable exceptions, limitations, identity-verification requirements, and other legal requirements.

Keydris may request information reasonably necessary to verify:

  • your identity;
  • the validity of your request; and
  • your authority to make a request on behalf of another individual.

Keydris will not unlawfully discriminate against an individual for exercising applicable privacy rights.

Where Keydris processes personal information on behalf of a customer, Keydris may direct you to the relevant customer or assist that customer as appropriate.

Privacy requests may be submitted to:

15. Marketing Communications

Where permitted by applicable law, Keydris may send communications regarding Keydris products, Services, events, updates, or other business matters.

You may unsubscribe from promotional emails using the unsubscribe method included in the communication.

Even after opting out of promotional communications, Keydris may continue sending communications reasonably necessary for:

  • account administration;
  • security;
  • Service operation;
  • transactions;
  • contractual matters; or
  • legal notices.

16. Third-Party Services

The Services may link to, interoperate with, or be used alongside third-party:

  • websites;
  • applications;
  • APIs;
  • AI models;
  • protocols;
  • networks;
  • platforms;
  • infrastructure; or
  • other services.

Keydris does not control the independent privacy practices of those third parties.

Customers should evaluate third-party services and review their terms and privacy policies before enabling or using integrations.

17. Children’s Privacy

Keydris Services are designed for businesses and organizations and are not directed to children.

Individuals under 18 should not create or administer Keydris business accounts.

If Keydris learns that personal information from a child has been provided contrary to this Policy, Keydris may take appropriate steps to remove it.

18. Changes to This Privacy Policy

Keydris may update this Privacy Policy as its:

  • Services;
  • technology;
  • business;
  • data practices;
  • security practices; or
  • legal obligations
  • change over time.

When Keydris updates this Privacy Policy, the revised version will be published with an updated effective date.

If applicable law requires additional notice or consent for a material change, Keydris will provide it as required.

19. Contact Us

Questions, privacy requests, security reports, or concerns relating to this Privacy Policy or Keydris’s privacy practices may be submitted to:

  • Keydris, Inc.

Email: security@keydris.com

When contacting Keydris about a privacy request, please provide sufficient information for Keydris to understand the request and, where reasonably necessary, verify your identity or authority.

If your request relates to personal information Keydris processes on behalf of a customer organization, Keydris may direct you to that organization or assist the organization as appropriate.