Privacy Policy

SanctiKey, LLC ("SanctiKey," "we," "us," or "our") is a Massachusetts limited liability company operating at the registered address of Northwest Registered Agent Service Inc., 82 Wendell Ave., STE 100, Pittsfield, MA 01201. We provide managed cryptographic infrastructure, encryption, key management, and security tooling as a Software as a Service (SaaS) platform (the "Service").

This Privacy Policy explains how we collect, use, store, and protect information when you visit our marketing website (the "Site") or use our Service. It also explains your rights with respect to your information.

By accessing the Site or using the Service, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree, do not access the Site or use the Service.

When customers submit data to our cryptographic API endpoints ("API Payloads"), SanctiKey performs the requested operations and returns the result without retaining the payload. Our custody model is:

• Keys are non-extractable. Customer cryptographic keys are generated and held as non-extractable material in AWS KMS within the customer’s dedicated AWS account. No one, including SanctiKey, can export the raw key bytes.
• SanctiKey operates the keys, only on your instruction. SanctiKey’s systems use your keys solely to perform the operations you request through the Service’s API, including decryption when you request it. SanctiKey controls the key policies until you exercise the Keyout right described in the Business Continuity and Keyout Policy.
• No payload retention. SanctiKey does not store the plaintext or ciphertext content of API Payloads. Optional asynchronous operations for large payloads stage data briefly in encrypted object storage and delete it upon completion. Because no payload content is retained, SanctiKey cannot produce your data in response to a legal demand; if legal process seeks to compel a cryptographic operation on data presented to SanctiKey, we will notify you unless legally prohibited from doing so.

Encrypted payload content is structurally outside the scope of personal data SanctiKey collects or controls under this Privacy Policy.

The Site and Service are intended solely for use by individuals who are 18 years of age or older and who have the legal authority to enter into binding agreements on behalf of themselves or their organization. By accessing the Site or using the Service, you represent and warrant that you meet these eligibility requirements.

We do not knowingly collect personal information from individuals under the age of 18. If we become aware that we have inadvertently collected such information, we will take prompt steps to delete it.

We use the information we collect for the following purposes:

We do not use your information for targeted advertising. We do not sell your personal information to third parties. We do not use your information to make automated decisions that produce legal or similarly significant effects without human review.

We do not sell, rent, or trade your personal information. We may share your information only in the following circumstances:

SanctiKey is built as a security-first platform. We implement the following technical and organizational measures to protect your information:

• Encryption in transit: All data transmitted between your browser or API client and SanctiKey’s infrastructure is encrypted using TLS 1.2 or higher. Unencrypted HTTP connections are not accepted.
• Encryption at rest: Data stored in our databases and object storage is encrypted at rest using AES-256 or AWS Key Management Service (KMS).
• Authentication: Multi-factor authentication (MFA) is enforced on the Service. Account credentials are never stored in plaintext.
• Access controls: Access to customer data within SanctiKey’s systems follows the principle of least privilege. SanctiKey engineering and operations staff do not have routine access to customer account data except to monitor the health and deployment status of the infrastructure.
• Non-extractable key architecture: SanctiKey cannot extract or export your cryptographic key material in plaintext. Your private keys are generated and held as non-extractable material in AWS KMS and are used only to perform the cryptographic operations you request; neither SanctiKey personnel nor infrastructure can read the raw key bytes. This is an architectural guarantee, not solely a policy commitment.
• Audit logging: All administrative and sensitive operations are logged with tamper-evident audit trails retained for compliance purposes.

No security system is impenetrable. While we employ industry-standard measures, we cannot guarantee absolute security of information transmitted over the internet. You are responsible for maintaining the security of your account credentials, API tokens, and MFA devices.

We retain your personal information for as long as your account is active or as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements.

Upon account termination:

• Account identity and contact information is retained for a period of 90 days to support account recovery and dispute resolution, after which it is deleted or anonymized
• Transaction records are retained for a minimum of 7 years to satisfy tax and financial recordkeeping requirements
• Security and audit logs are retained for periods required by applicable compliance frameworks, up to 7 years
• Aggregated and anonymized telemetry data that cannot be linked to an individual may be retained indefinitely for product improvement purposes

You may request deletion of your personal information in accordance with Section 10 below.

Depending on your jurisdiction, you may have the following rights with respect to your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information, subject to legal retention requirements
• Portability: Request your personal information in a structured, machine-readable format
• Objection: Object to certain processing activities based on legitimate interest
• Restriction: Request that we restrict processing of your information in certain circumstances

To exercise any of these rights, contact us at privacy@sanctikey.com. We will respond to verified requests within 30 days. We may need to verify your identity before processing your request.

We will not discriminate against you for exercising your privacy rights.

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights regarding your personal information, including:

• The right to know what personal information we collect, use, disclose, and sell
• The right to request deletion of your personal information
• The right to opt out of the sale of your personal information

SanctiKey does not sell personal information. We do not sell your personal information to third parties for monetary or other valuable consideration.

To exercise your CCPA rights, contact us at privacy@sanctikey.com. You may designate an authorized agent to make a request on your behalf.

SanctiKey is operated and managed exclusively within the United States. The Service is intended solely for use by individuals and entities located within the United States.

SanctiKey does not permit access to or use of the Service by individuals or entities located outside the United States, including residents or entities within the European Union, the European Economic Area, or the United Kingdom. Any attempt to access the Service from outside the United States is unauthorized and a violation of these Terms.

SanctiKey does not knowingly collect information from individuals outside the United States. All data processed through the Service is stored and managed within the United States, subject exclusively to United States federal and state law.

SanctiKey's Service involves cryptographic technology subject to United States export control laws, including the Export Administration Regulations (EAR). By using the Service, you represent and warrant that you are not located in, under the control of, or a national or resident of any country to which the United States has embargoed goods or services, and that you are not listed on any United States government list of prohibited or restricted parties. SanctiKey reserves the right to refuse or terminate service in order to comply with applicable export control laws.

The Site may contain links to third-party websites or services that are not operated by SanctiKey. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party sites you visit.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email to the address associated with your account and by updating the "Last Updated" date at the top of this document. We encourage you to review this Privacy Policy periodically.

Your continued use of the Site or Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

SanctiKey, LLC Privacy Inquiries
Email: privacy@sanctikey.com

For security-related disclosures, please contact: security@sanctikey.com

This Privacy Policy is effective as of the date listed above and supersedes all prior versions.