Keynetic

Trust & security

The questions you should ask any software that holds your bookings.

Answered plainly. Everything on this page describes how Keynetic runs today, not a roadmap. It is the setup behind 72 rental companies in 42 countries.

Who is behind it

Registered company

  • CARVENIENCE BOOKINGS
  • Cartesiusstraat 90, 2562 SL Den Haag, The Netherlands
  • KVK 74753525
  • BTW NL002476041B96

Keynetic is the trade name. The company runs its own rental fleet; the software grew out of that counter. Read the story.

How it makes money

Every feature is free. Revenue comes from an optional white-label subscription, a 0.5% fee on card charges taken through Keynetic, and a 3% fee on bookings that arrive through the public booking widget. There is no per-vehicle tax, no tier to outgrow, and no reason for us to hold your data hostage. Pricing.

Where your data lives

Hosting

Dedicated servers in Nuremberg, Germany (European Union), fronted by Cloudflare. Traffic is TLS only.

Isolation between companies

One database, but every tenant-scoped table is protected by PostgreSQL row-level security. The application connects as a role that physically cannot read another workspace's rows, even if application code has a bug. Staff at Keynetic use a separate role and only look at a workspace on your request.

Backups

A full database backup every night, kept for 14 days locally, with an encrypted copy shipped to a second server in a different data centre and kept for 30 days. Uploaded documents and photos are snapshotted on the same schedule.

Security

Accounts

Passwords are hashed with bcrypt and never stored in clear. Two-factor authentication (TOTP authenticator app, with backup codes) is available to every user under Settings → Security. Sessions are signed tokens with a fixed expiry; sign-in and password endpoints are rate limited.

Card data

Card numbers never touch Keynetic. Payments, deposit holds and payouts run through Stripe, which is PCI DSS Level 1 certified; Keynetic stores only the Stripe reference. Card terminals at the counter work the same way.

Customer signatures and damage evidence

Contracts, signatures, check-out and check-in photos are stored with the booking, time-stamped, and rendered into the PDF the customer receives. They are yours to download at any time.

Certifications

None to sell you. SOC 2 and ISO 27001 are audit products priced for enterprises; for an independent rental company they mostly buy a badge. We put the money into the controls above and describe them here so you can judge them yourself. If your insurer or a corporate client needs a specific questionnaire answered, email us and we answer it in writing.

Your data is yours

Export

Every table (bookings, customers, fleet, payments, contracts) downloads as CSV from Settings → Data, at any time, with no request form and no exit fee. It works during the trial and keeps working if you leave.

Deletion

Ask from the owner address and the workspace is deleted within 30 days; invoices we must keep under tax law are retained for the statutory period only. Details.

Sub-processors

  • Stripe, payments and payouts (card data, payout bank details)
  • Resend, transactional email (recipient address, message)
  • Meta WhatsApp Business Platform, only when you send a WhatsApp (phone number, message)
  • Cloudflare, edge network and DDoS protection (request metadata)
  • netcup GmbH, server hosting in Germany

No advertising networks, no data brokers, no model training on your data.

Questions

Write to [email protected]. You get a written answer from the people who run the servers, not a ticket number.