Security

No passwords change hands.

Your client grants access on each platform's own screens, and GetSetKeys keeps only the proof that each step was done. This page is written for your client's IT team, so send it to them.

Email this page to ITAsk a security question

What we never ask for

  • Nevera passwordNo step asks for one, and the agency never receives one.
  • Nevera two-factor codeSign-ins happen on the platform's own page, with its own checks.
  • Neveran API keyAccess is granted as a named user or role that the client can remove any time.

How each step is proven

Three ways, and none of them is a password.

Each platform uses the strongest way it supports. The client's link says which one, step by step.

The platform's own invite

The client invites the agency on the platform's own Users screen, with the role the agency asked for. The platform emails the agency, the agency forwards that email to its GetSetKeys address, and the step turns green. We keep the email's sender, subject and time as the record.

App Store Connect, Stripe, WP Engine, Webflow, Shopify and most others

A public DNS lookup

The client adds the records the agency needs where their domain is managed. We look the domain up the way anyone on the internet can, and check again every 10 minutes until the records match. No DNS login and no account access.

Namecheap, GoDaddy, Cloudflare, Squarespace and other DNS providers

One click, used once

Where a platform supports it, the client signs in on the platform's own page and approves. We use that access once to add the agency, then throw it away. For GitHub, the client's token is revoked and our app uninstalled straight after, so nothing is left to reuse.

GitHub today, with more platforms at launch

What we keep

Only the proof, and only as long as it's needed.

The service's data is stored with Cloudflare and served over HTTPS. The privacy policy has the full detail.

WhatWhyFor how long
The agency's teamNames and email addressesSigning in and notificationsWhile the account is open, then deleted within 30 days
Each client linkThe client's name and email, the steps, their status and a due dateRunning the linkWhile the account is open, then deleted within 30 days
Proof of each stepAn invite's sender, subject and time, the DNS records found, a one-click resultThe agency's record of who got access to what, and whenWhile the account is open, then deleted within 30 days
Files the client uploadsSuch as a logo or brand guidelinesHanding them to the agency, private to its team, through short-lived download linksDeleted 30 days after the link is done, with an email to the agency a week before
Questions on the linkThe client's questions and the answersSo the agency's team can see and answer themWith the link, while the account is open
Devices that open a linkA one-way hash of a random browser id, a device label and a countryTelling the agency when a link opens somewhere newWith the link; cleared when the link is replaced

Every link, locked down

  • An address nobody can guess

    Each link ends in 10 random characters. The agency can replace it at any time, and the old address stops working at once.

  • New devices are noticed

    The agency sees when a link opens on a device it hasn't seen before, and can ask for an email code before a new device gets in.

  • It closes itself

    Fourteen days after the last step is done, the link closes. The agency can reopen it if something changes.

  • Handover is a checklist

    When a project ends, a handover link walks the client through removing each access, and the access record exports as a CSV.

Porter, the AI setup helper

It answers. It never asks for a password.

Porter answers the client's questions from the steps on that link and the live checks, and each answer has to quote the page it relies on. It can't mark a step done, it passes anything it can't answer to the agency, and the agency sees every exchange and can turn it off. Our AI provider, named in the privacy policy, processes a question only to answer it and doesn't train on it.

Who runs it

  • CloudflareHosting, storage, files and network security
  • ClerkSign-in for agency teams
  • ResendSetup links, reminders and codes by email
  • Dodo PaymentsPayments, as merchant of record. We never see a card number

Found a problem? Tell us.

Email hello@getsetkeys.com with Security in the subject. We read every report, and we'll tell you what we changed.

Claim a founding place