Trust

How oakallow handles your data, the vendors we rely on, what we commit to today, and what we're working toward. Everything on this page reflects what we ship. We'd rather under-promise here than write something we can't back up.

Where your data lives

All of our application data lives on Cloudflare's infrastructure (Workers, D1, KV, R2). That includes your account record, permission rules, API key hashes, audit log, approval history, and support attachments. Cloudflare encrypts data at rest by default and runs the network we serve our traffic from.

Payment processing, push delivery, and email delivery route through a small set of specialist vendors listed below. We never hand your full API keys or your account password to any third party. Keys are stored as SHA-256 hashes and we don't use passwords at all.

The oakallow trust boundary. Oakallow runs at the edge handling permission resolution in D1 and the immutable audit log. The human approver keeps decision authority. MFA is enforced and signed in-app. Alerting is notify-only and never decides anything. Customer secrets are never shared with oakallow.

Subprocessors

These are the third-party services that touch customer data in some way. Each entry says what they do for us and what is shared.

Cloudflare
Privacy

Compute, storage, networking. Workers run the application code, D1 stores account and permission data, KV caches auth lookups, R2 stores support attachments and blog media, Turnstile blocks bot traffic on the sign-in page.

Data shared: Account records, permission rules, audit logs, support attachments.
Stripe
Privacy

Web credit-pack purchases. Stripe Checkout handles the payment, Stripe Webhooks notify us when a charge succeeds so we can credit your account.

Data shared: Billing email, transaction amount. Card data goes directly to Stripe and never touches our servers.
Apple StoreKit
Privacy

In-app credit purchases on iOS. Apple handles the payment; we verify the signed receipt to credit your account.

Data shared: Apple-issued transaction identifier. Card data stays with Apple.
Google Play Billing
Privacy

In-app credit purchases on Android. Google handles the payment; we verify the purchase token to credit your account.

Data shared: Google-issued purchase token. Card data stays with Google.
Resend
Privacy

Transactional email delivery (sign-in codes, approval notifications, billing receipts) and inbound email handling for support replies.

Data shared: Recipient email address, message subject and body.
Apple Push Notification service (APNs)
Privacy

Delivers push notifications to the iOS app (approval requests, security alerts).

Data shared: Device push token, short notification payload.
Firebase Cloud Messaging (FCM)
Privacy

Delivers push notifications to the Android app (approval requests, security alerts).

Data shared: Device push token, short notification payload.

What we collect (and what we don't)

We do collect

  • Your account email and team membership
  • Permission rules and tool catalog you configure
  • Audit log of every tool execution and approval decision
  • API key hashes (never the raw key)
  • Sign-in events (timestamp, IP, country derived from IP)
  • Billing transactions (amount, source, timestamp)

We don't collect

  • Passwords. We don't use them
  • Payment card numbers. Stripe and the app stores hold those
  • The contents of your tool's actual API responses
  • Third-party analytics or advertising trackers on the dashboard
  • Voice, video, or any biometric template (passkeys verify locally on your device)

Account deletion

Email support@oakallow.io from the address on your account and we'll delete it. API keys, passkeys, and recovery codes are revoked immediately; personal data is removed within 30 days. Billing records may be retained where required by law.

What we don't claim yet

We don't carry a formal SOC 2, ISO 27001, or HIPAA attestation today. We've built the controls described on the Security page, and a formal attestation is on the roadmap.

If your procurement process needs an attestation today, please reach out at security@oakallow.io. We'll walk through our current controls and our timeline.

oakallow is operated by Islemonics Studios LLC.
Patent Pending. U.S. Provisional Patent Application No. 64/055,617.