Security

How Keelix handles your data

Your raw docker-compose.yml and .env file contents are NOT stored by Keelix Cloud. Scanning runs on your own machine (the CLI or your self-hosted worker); only the resulting structured findings, scores, target hostnames, and metadata are uploaded to the dashboard. Secret values detected by a check are reported by location/name, never by uploading the secret value itself.

Scoring and pass/fail are produced by deterministic checks. The optional AI layer only rewrites explanations and drafts remediations — it never changes a score or a check result.

Tenant isolation

The hosted dashboard is multi-tenant. Every per-tenant query is scoped to your organization, and the database enforces row-level security so one organization cannot read another's data.

Authentication & access

Sign-in uses magic links / OAuth via our auth provider. API keys for scan ingest are stored hashed (never in plaintext), are scoped to one organization, and can be revoked instantly. Optionally, scan ingest can be restricted to an IP allowlist.

Subprocessors

We rely on Supabase, Vercel, Stripe, Resend, WorkOS, Anthropic to operate the service. See the Privacy Policy for each one's purpose and a link to their terms.

Responsible disclosure

We welcome coordinated disclosure. Email the address above with steps to reproduce; we aim to acknowledge within 3 business days. Please do not run automated scans against other tenants or attempt to access data that is not yours.

Contact: info@keelix.dev.