What we keep, and what we never hold
Who Has The Keys never asks for a password, a recovery code or a two-step code, and has nowhere to store one. It records who controls each account and how they sign in, never how to get in.
What we never hold
- passwords, for any account, yours or the business’s
- recovery codes, backup codes or two-step codes
- answers to security questions
- card numbers: Stripe takes the payment and holds the card details
The register has no field for any of these. If someone needs to get into an account, the register says who can let them in, not how.
What the free check keeps
The free check needs no account and no email address. It keeps the address you checked and the result for an hour, so checking again is quick and the public records are not asked twice. To stop the check being misused, it limits how many checks can come from one connection.
What the register keeps
- your email address, to sign you in and send you alerts
- the business’s name and its domains
- for each account: the service, who is the keeper and the admins, which email address signs in, whether two-step login is on, who pays and when it renews
- the names and email addresses of the people you name for break-glass, and your instructions
- on the Freelancer plan, your business name and logo
How it is protected
- Signing in needs a link sent to your email address and a code from an authenticator app on your phone. The second step is compulsory for every account and can’t be switched off.
- The register is held in a database in London.
- Every page and every connection to the service is encrypted (HTTPS).
- We keep the least that does the job. Each item listed above is there because the register needs it.
Who else handles it
Vercel runs the website, Neon runs the database in London, Resend sends the emails and Stripe takes payments. The privacy notice says what each one receives and why.
What we don’t claim
Who Has The Keys doesn’t test your website or accounts for weaknesses, and it can’t tell you a business is secure. It shows who controls what, so gaps can be closed by the people who hold the keys.
Found a problem?
If you think you have found a security problem in Who Has The Keys, email hello@whohasthekeys.com. Please don’t test it against other people’s data.
Common questions
Do you need my passwords?
No. Who Has The Keys never asks for a password, a recovery code or a two-step code, and has nowhere to store one. The register records who controls each account and how they sign in, such as which email address they use and whether two-step login is on. It never records how to get in.
Where is my register kept?
In a database in London. Signing in needs a link sent to your email address and a code from an authenticator app on your phone, for every account, with no way to switch the second step off. Card payments are taken and held by Stripe; we never see the card number.
Why can’t the check show who owns my domain?
Most registries now hide the name and address of whoever registered a domain, to protect personal data. So the check can show where your domain is registered and when it renews, but not whose name is on it. That field, the registered keeper, is one only the business can fill in.
Does it make my business secure?
No, and we will never say it does. Who Has The Keys doesn’t test your website for weaknesses. It is a record of who controls each account the business depends on, kept up to date and watched, so the right people can act when something changes or runs out.