1. Keelbid
  2. Security

Security and data

What we are, and what we are not yet.

Specifics, not a padlock badge. This page says how your data is kept apart from every other client's, where it is stored, who can see it, how it is deleted, and which certifications we do not hold.

Private by construction

One cell per client.

Not one shared app with a client column. A separate copy of everything, per client.

Each client runs as its own small application on Cloudflare: its own worker, database, file bucket, search index, key-value store and encryption key, at its own address. A control plane holds the client list and numbers-only summaries, and no credential into any cell. Every request first checks it is inside the right cell, and a test suite walks every route to prove no path crosses between two.

Where it is stored

In the United States, with one caveat.

Your database and your files are stored in the United States. Cloudflare's D1 database and R2 file storage take a US jurisdiction at creation, and every cell is created with it.

The caveat. Two smaller pieces, Cloudflare's key-value store and its vector search index, offer no US-only setting. The store holds short-lived session records; the index holds numeric vectors made from your documents, which let the response find the right passage. Both may be served from Cloudflare's global network. We would rather say this than write "all data in the US" and be wrong.

Built on Cloudflare, whose government platform is FedRAMP Moderate authorized. Keelbid runs on the commercial platform; the authorization is Cloudflare's, not ours.

Encryption

In transit, at rest, one key per client.

  • In transit: TLS on every connection, including uploads and the links your experts open on their phones.
  • At rest: files are cut into one-megabyte chunks and encrypted with your cell's own key before they are stored. Cloudflare encrypts the storage underneath as well.
  • One key per client: your cell's key exists only in your cell. No other cell can read it; the control plane never holds it.
  • Sign-in: one-time links to your work email and a session cookie scoped to your own address. No passwords to leak.

Model training

Your documents never train a model.

Your documents are used to write your response and for nothing else. The model vendor we use, Anthropic, does not train on commercial customers' inputs or outputs by default, and we have not opted in; their policy: Is my data used for model training? Keelbid itself trains nothing.

Deletion

On request, backups included.

Write to hello@keelbid.com. We export what you own, then delete the whole cell: database, files, search index, key-value store, encryption key and sign-in records. The database keeps an automatic 30-day history; it expires on its own, so everything is gone within 30 days of your request. We confirm in writing.

Found something?

Report a vulnerability.

Write to hello@keelbid.com with what you found and how to repeat it. You get a reply within 48 hours and a fix date in writing once confirmed. Test only against sample.keelbid.com, which holds invented data.

The honest list

What we are, and what we are not yet.

We are

  • Built on Cloudflare, whose government platform is FedRAMP Moderate authorized
  • Storing your database and files in the United States
  • Encrypted in transit and at rest, one key per client
  • One private cell per client
  • Never training a model on your documents
  • Exporting and deleting everything on request

We are not yet

  • SOC 2 audited
  • FedRAMP authorized
  • CMMC assessed
  • A place for classified material
  • A place for ITAR technical data

The CUI note

Read this before you upload.

State, local, higher-education and commercial bids: fine. These buyers do not require CMMC or FedRAMP of the tools you write with, and a normal response to them holds no CUI.

Federal bids with controlled unclassified information: ask first. The Department of Defense's CMMC rule has applied to new contracts since November 2025, and from November 2026 many awards need a third-party Level 2 assessment. We have not been assessed and do not claim to meet NIST SP 800-171. Write to us with what the solicitation says and we will answer plainly; often the answer is to keep the CUI attachment out of the workspace.

Classified material and ITAR technical data: never. There is no vendor certificate for ITAR, so we do not say "ITAR compliant"; we say do not upload it.