Get KeyUp

For businesses

Trust and security at KeyUp

Last updated October 31, 2026

Before your team uses a new tool, someone usually asks: who is behind it, where is our data, and what happens to it? This page answers those questions in one place, so you can forward it to whoever needs to approve KeyUp. The full details are in the Privacy Policy and the Terms, which this page only sums up.

Who runs KeyUp

  • The business: KeyUp is run by its owner as a sole proprietorship in Pennsylvania, USA.
  • Funding: there are no investors and no ad business. How KeyUp works is on the About page.
  • Contact: [email protected] for help, [email protected] for contracts, privacy and security questions.
  • If KeyUp ever shuts down, you get reasonable notice and a way to download your data (Terms).

Where your data lives

  • Hosting: the KeyUp server runs on Microsoft Azure in a data center in the Central US region (United States). Microsoft supplies the computer; KeyUp runs the server software.
  • On the way there: app traffic reaches the server through Cloudflare. Cloudflare ends the encrypted (TLS) connection and passes the traffic on through a secure tunnel, so it can technically see traffic that is not end-to-end encrypted as it passes.
  • Backups: the database is backed up every night and before each update, and each night’s backup is also copied to a second machine we control. Every copy is kept for at most 30 days.
  • Other providers: each one and what it does is listed in the Privacy Policy (“Our service providers”). We don’t sell your data, there are no ads, and we don’t use your voice, messages or transcripts to train AI models.

What is encrypted

  • Everything in transit between your devices and our servers is encrypted (TLS).
  • Private 1-to-1 calls (beta) are end-to-end encrypted: our servers pass the audio along without being able to hear it.
  • Rooms, messages and regular calls are not end-to-end encrypted. Our server handles them as they pass so features like Replay, transcripts and Heard by can work. We say this plainly rather than over-promise.
  • Stored secrets: passwords are hashed; push tokens, AI keys and transcription keys are stored encrypted.

The full picture, room by room, is on How KeyUp protects you.

How long data is kept

  • Live talk is not saved. The one exception: a talk a device may have missed because its connection dropped is held in the server’s memory, never on disk, for up to 5 minutes so it can be played to that device when it is back.
  • Replay clips and transcripts exist only when a room turns them on and the speaker agreed, for the room’s keep time (Replay: 1 hour by default, up to 90 days on Business; transcripts: 7 days by default, up to 365 days).
  • Room messages, photos and voice notes follow your plan’s history window (365 days on Business).
  • Backups are kept for at most 30 days, then removed.

Every kind of data and its time is listed in the Privacy Policy (“How long we keep it”).

Who can see your data

  • The people in your Space see what they share there, and your Space’s owners and admins see what their role allows (for example, reports about people in your Space).
  • Inside KeyUp, only the person who runs KeyUp can access stored data, and only to keep the service running, keep it safe, or help you when you ask. Microsoft hosts the data on Azure.
  • Data goes to authorities or others only when the law requires it, or to protect someone’s safety or our rights (see Legal contacts). Apparent child sexual abuse material is reported to NCMEC, as US law requires.
  • An AI assistant or transcription service your Space connects with its own key works under your account with that company, not ours. Nothing goes to one unless your Space turns it on.

What your company controls

  • Who is in: owners and admins add and remove members, set roles, and give time-limited guest passes.
  • What is kept: Replay, transcripts and the assistant are set per room. New rooms keep nothing (“Keep a copy of talks: Nothing”) and have the assistant off until an owner or admin turns them on.
  • Leaving: each person can download their own data at any time (there is no organization-wide export yet). Deleting the Space (owners only) or an account deletes its data, apart from the few records the Privacy Policy lists, such as billing records; backups follow within 30 days. Canceling a plan deletes nothing.

If something goes wrong

  • If a security incident affects your organization’s data, we tell your Space owner by email without undue delay, and within 72 hours of confirming it, with what happened and what we are doing.
  • Found a vulnerability? See our Security page for how to report it.
  • Uptime is checked from outside by Honeybadger. KeyUp makes no uptime guarantee.

What we don’t have yet

To be straight about it: KeyUp has no security certification (such as SOC 2), no single sign-on (SSO), no organization-wide data export and no uptime guarantee yet. It is built and run by one person. If one of these matters for your company, tell us.

Payments

Web plans are paid through Stripe on Stripe’s own checkout page; Android plans through Google Play. We never see card numbers. Refunds follow the Refund policy.

Documents for your files

Have a security questionnaire? Send it to [email protected]. We answer one a year for each organization, and again after any incident.