Security
Plain facts about where your data lives, who can read it, what the AI does with it and how it's deleted. This page describes how the product works today; it is not a certification.
§ 1
Each account's data is kept apart
- Row-level security on every table
- Every table in the database has row-level security switched on, so a request made as a signed-in user reaches only that account's rows: one agent can't read another's deals, clients or documents. An automated test fails if any table is left without it.
- Teams share only what they should
- Deals stay private to the agent who owns them, even inside an organization. On Team and Brokerage plans, contract reviews are shared with the organization's seated members, and teammates see each other's name, email and role, nothing more.
- Owner-only controls
- Only an organization's owner can invite agents or change its branding.
- Server-only records stay on the server
- Internal ledgers, such as AI usage, can't be read from the app at all.
§ 2
Files stay private
- Private storage buckets
- Contracts, deal documents, receipts and signature images are kept in private storage, in a folder per owner, and storage rules let only that owner reach it.
- Signed links that expire
- Private files open through signed links that expire after an hour.
- Public on purpose
- Listing photos, flyers and branding logos are public, because they appear on your public property page and client portal.
- Private links for signers and clients
- Signing links expire after 14 days and client portal links after 30. Signing links are stored only as a hash.
- Encrypted in transit, no card numbers
- Traffic to KeyRally is encrypted in transit. Payments run through Stripe, so KeyRally never sees or stores your card number.
§ 3
The AI reads your contract to answer you
- Contracts go to Anthropic's API
- Contract review and the other writing features use Anthropic's Claude models through Anthropic's API, and under Anthropic's commercial terms, API inputs are not used to train models.
- Photos go only where you send them
- Photo enhancement and virtual staging send only the photos you choose to fal.ai, the image service behind them.
- No document text in the usage ledger
- KeyRally meters AI use per account. That ledger records what was used, never the prompt or the text of your documents.
- Not for sale
- KeyRally doesn't sell your data or share it with third parties for marketing.
§ 4
Deleting data means deleting it
- Deleting a client
- Their record goes, along with their phone number, email address and the wording of texts and emails sent to or from them, and anything still scheduled to them is cancelled. What's kept is proof their choices were honoured: when they opted out of or back into texts, with their number stored only as a keyed one-way hash.
- Deleting a document
- Its file is removed from storage. A signed document is kept as signing evidence.
- Deleting your account
- Email support@quantumlooplabs.com from your account's address. Your files are removed from storage, your account and everything in it is deleted, your subscription is cancelled, and only the billing records tax rules require are kept.
- Backups roll off
- Encrypted backups can hold a copy for up to 30 days after deletion.
§ 5
Texts only with consent
- Opt-in per client
- A client gets texts only after you record that they agreed, and the time of the opt-in is saved on their record. There is no bulk opt-in.
- STOP works everywhere
- A reply of STOP, STOPALL, UNSUBSCRIBE, CANCEL, END or QUIT opts the number out at once, for every agent who texts it, and plain requests such as “stop texting me” count too. START opts back in, and HELP gets a reply with our support address.
- Verified webhooks
- Incoming texts are accepted only when they carry a valid Twilio signature.
- Every text is logged
- Each text goes through a server queue that records the message and when it was sent.
§ 6
Report a security issue
If you think you've found a vulnerability, email support@quantumlooplabs.com with “Security” in the subject and the steps to reproduce it. Please don't access, change or delete data that isn't yours while you test.
Email a security reportTry it on your next contract.
Upload a real contract and see what comes back: the terms, the risk flags and every deadline.
7-day free trial · No card needed