Trust & security
The questions you should ask any software that holds your bookings.
Answered plainly. Everything on this page describes how Keynetic runs today, not a roadmap. It is the setup behind operators in 46 countries.
Who is behind it
Company details
Pricing
Every feature is free, and every fee is published on Pricing.
Where your data lives
Hosting
Dedicated servers in Nuremberg, Germany (European Union), fronted by Cloudflare. Traffic is TLS only.
Isolation between companies
One database, but every tenant-scoped table is protected by PostgreSQL row-level security. The application connects as a role that physically cannot read another workspace's rows, even if application code has a bug. Staff at Keynetic use a separate role and only look at a workspace on your request.
Backups
A full database backup every night, kept for 14 days locally, with an encrypted copy shipped to a second server in a different data centre and kept for 30 days. Uploaded documents and photos are snapshotted on the same schedule.
Security
Accounts
Passwords are hashed with bcrypt and never stored in clear. Two-factor authentication (TOTP authenticator app, with backup codes) is available to every user under Settings → Security. Sessions are signed tokens with a fixed expiry; sign-in and password endpoints are rate limited.
Card data
Card numbers never touch Keynetic. Payments, deposit holds and payouts run through Stripe, which is PCI DSS Level 1 certified; Keynetic stores only the Stripe reference. Card terminals at the counter work the same way.
Customer signatures and damage evidence
Contracts, signatures, check-out and check-in photos are stored with the booking, time-stamped, and rendered into the PDF the customer receives. They are yours to download at any time.
Certifications
None to sell you. SOC 2 and ISO 27001 are audit products priced for enterprises; for an independent rental company they mostly buy a badge. We put the money into the controls above and describe them here so you can judge them yourself. If your insurer or a corporate client needs a specific questionnaire answered, email us and we answer it in writing.
Your data is yours
Export
Every table (bookings, customers, fleet, payments, contracts) downloads as CSV from Settings → Data, at any time, with no request form and no exit fee, and it keeps working if you leave.
Deletion
Ask from the owner address and the workspace is deleted within 30 days; invoices we must keep under tax law are retained for the statutory period only. Details.
Sub-processors
- Stripe, payments and payouts (card data, payout bank details)
- Resend, transactional email (recipient address, message)
- Meta WhatsApp Business Platform, only when you send a WhatsApp (phone number, message)
- Cloudflare, edge network and DDoS protection (request metadata)
- netcup GmbH, server hosting in Germany
No advertising networks, no data brokers, no model training on your data.
Questions
Write to [email protected]. You get a written answer from the people who run the servers, not a ticket number.