LEGAL // PRIVACY POLICY
Privacy Policy
This policy explains what Keoir Enterprises, LLC ("Keoir", "we") collects when you use sgt.sh (the "Service"), why we collect it, and the choices you have. sgt.sh is a platform for relaying SSH connections and AI-agent activity to servers you control — by design, it handles sensitive operational data, and this policy is written to be specific about it.
1. Data we collect
Account and organization
- Your email address and a salted hash of your password (we never store the password itself).
- Your organization's name, plan, and settings.
Billing
- Payment is processed by Stripe. Your card details go directly to Stripe and never touch our servers; we store only Stripe's identifiers for your customer record, subscription, and invoices, plus your subscription status and capacity.
Endpoints and credentials
- Endpoint connection details you register: hostnames, IP addresses, ports, usernames, and labels.
- Credentials you place in the vault (SSH private keys, passwords). These are encrypted at rest and are used only to establish the connections you or your agents request; they are never exposed to agents and never appear in logs.
Sessions, commands, and audit records
- Operational records of SSH sessions: which user or agent opened them, the target endpoint, the relay and egress IP used, timestamps, and byte counts transferred.
- Commands executed through the Service (including commands proposed by agents), policy decisions, and approval events, kept in a tamper-evident audit log so you can review exactly what happened on your systems.
- Terminal input/output is relayed through our infrastructure to operate the session.
- Files you transfer through the Service pass through our relays in transit.
Agents and API tokens
- Agent names, their endpoint scopes, and hashed API/agent tokens.
Technical data
- Standard server logs: request metadata, client IP addresses, and user-agent strings, used for security and troubleshooting.
- A session cookie to keep you signed in to the dashboard. We use no advertising or cross-site tracking cookies. Your theme preference is stored locally in your browser and never sent to us.
2. How we use data
- To provide the Service: establish SSH sessions, enforce the policies you configure, route traffic through the egress IPs assigned to you, and show you live and historical session activity.
- To secure the Service: authenticate users and agents, detect abuse and unauthorized access, and maintain audit integrity.
- To bill you and to communicate about your account (service notices, security alerts, billing).
- To comply with legal obligations.
We do not sell your data, use your session content for advertising, or use your commands, terminal output, or credentials to train machine-learning models.
3. Third parties we share data with
- Stripe — payment processing (your email and billing details).
- Infrastructure providers — the cloud and network providers that host our control plane, database, and relay fleet. They process data on our behalf under their own security commitments.
- AI providers you connect — if you attach your own LLM or point an MCP client (e.g. Claude, Cursor) at the Service, the content those tools exchange with the Service (commands, output excerpts) is handled by that provider under your agreement with them. Choose your providers accordingly.
- Legal requests — we disclose data when required by valid legal process, and will notify you where we are permitted to.
4. Retention
- Account, endpoint, and vault data: kept while your account is active. When you delete a credential or endpoint, it is removed from the live system; when you close your account, remaining Customer Data is deleted within 30 days of request.
- Audit logs and session records: retained while your account is active so your history remains reviewable, and for a limited period after termination where needed for security, billing disputes, or legal compliance.
- Billing records: retained as required by tax and accounting law.
5. Security
Credential handling is the core of this product, and the architecture reflects that: vaulted credentials are encrypted at rest; agents never receive keys — sessions are opened with short-lived SSH certificates pinned to the originating relay; sessions run in isolated containers; audit logs are hash-chained to make tampering evident; and access to production systems is restricted. No service can promise perfect security — report suspected vulnerabilities or incidents to me@keoir.dev.
6. Your rights
You can access and update account data in the dashboard. Depending on where you live (e.g. the EEA/UK under GDPR, or California under CCPA), you may have rights to access, correct, export, delete, or restrict processing of your personal data. To exercise them, email me@keoir.dev; we will respond within the period required by applicable law. Note that most data in the Service is operational data about your servers under your organization's control — your organization's administrators control it.
7. Children
The Service is not directed to anyone under 18, and we do not knowingly collect personal data from children.
8. Changes
We may update this policy; for material changes we will notify you by email or in the dashboard before they take effect, and we always update the effective date above.
9. Contact
Privacy questions and requests: me@keoir.dev.