What we do with access

Clerk & Key reads a company directory so a non-technical owner can see who holds the keys. The ask is read only: users, admin roles, licenses, and connected apps.

We do not store passwords for Google, Microsoft, the bank, the registrar, or any other system. A field can say where a login is kept. If the text looks like a password, it is refused.

Directory tokens are encrypted before they are saved. Each company only sees its own people, systems, and runbooks. Sign-in is a signed cookie. There is no password for Clerk & Key itself.

Billing is wired for Stripe test mode. Live secret keys are refused. The engineer checklist before a real customer connects is in SECURITY.md in the project.