Privacy
What we store, and what we refuse to
Ratchet decides whether an agent may perform a side effect. Doing that well needs surprisingly little of your data, and the design deliberately keeps it that way.
What we never store
The payload of a gated effect. When you call begin, the
payload you send is hashed and discarded. We keep
sha256(canonicalize(payload)) and nothing else. That fingerprint lets us
detect a key reused for different work; it cannot be reversed into the recipient, the
amount, or the message.
Credentials for your vendors. Ratchet holds no Stripe key, no mail provider key, no access to any system of yours. It cannot perform the effects it authorises, which is the point — and it means a breach of Ratchet cannot be used to act on your behalf.
API keys in a recoverable form. Keys are stored as an HMAC-SHA256 digest under a server-side pepper. A copy of our database does not yield a usable key.
What we do store
- Workspace — name, owner email, plan, credit balance.
- Effects — the effect type, your idempotency key, the payload
fingerprint, decisions, attempts, outcomes, and any
resultyou report so later duplicate callers can replay it. You choose what goes in a result; do not put anything there you would not want stored. - Receipts — a signed record of each decision, containing the same fields plus the key that signed it.
- Audit events — operator actions such as key creation and policy changes.
- Request metadata — method, path, and a request id. Logs redact
authorization,x-api-key,cookie, and payment signature headers, and request bodies are never logged.
Idempotency keys are stored as you send them. If you derive them from something personal — an email address, an account number — that value is stored. Deriving them from a hash of the work avoids this entirely, and is good practice for other reasons too.
How long
- Effects — governed by the retention you set per effect type; 7 days by default. Deleted by an automated sweep after that.
- Receipts — 90 days. Older ones are pruned behind a signed checkpoint so the audit chain stays verifiable across the gap.
- Anonymous workspaces — deleted after 7 days of inactivity, unless claimed. Using one resets the clock; claiming it with an email makes it a normal workspace that is never swept. An unclaimed workspace you stop using is removed along with its effects and receipts.
- Backups — database snapshots retained 30 days; logical backups stored off-machine.
Who else processes it
| Processor | Purpose | Where |
|---|---|---|
| Fly.io | Application hosting and database | United States |
| Tigris | Encrypted database backups | United States |
| Stripe | Card payments | United States / global |
| Resend | Transactional email | United States |
| Cloudflare | DNS and inbound email routing | Global |
Card details never touch our servers. Stripe collects them directly; we store only a customer reference and a payment reference.
Where it lives
All application data is stored in the United States (Fly.io, region sjc).
There is currently no EU-resident option. If your obligations require
EU residency, Ratchet does not meet them today, and we would rather say so than let you
find out later.
Your rights
You can export or delete your workspace data at any time. Deleting a workspace removes its effects, receipts, keys, and audit trail; backups age out on the schedule above. Write to privacy@ratchetgate.com and we will respond within 30 days.
Cookies
One: rk_session, set only when you sign in to the console. It is
HttpOnly, SameSite=Lax, Secure, and holds nothing
but a session reference. No analytics, no advertising, no third-party
trackers. There is no cookie banner because there is nothing to consent to.
Security reports
security@ratchetgate.com, also published in security.txt. Our posture is described on the security page.
This describes how the service actually behaves, verified against the code. It is not legal advice, and it has not been reviewed by a lawyer. If you are relying on it for compliance, have your own counsel read it.