Trust & Security

Location data is sensitive. Here's exactly how we protect the data you and your end users trust us with — described plainly, and only what we actually do.

At a glance

Data protection

In transit. The API (api.geofencekit.com), dashboard (app.geofencekit.com), and SDK calls are all encrypted with TLS. Certificates are managed and auto-renewed by our platform provider.

At rest. Configuration and event data are stored in a managed PostgreSQL database (Neon) that encrypts data at rest and maintains automated backups with point-in-time recovery. We do not store data on our own hardware.

Authentication & access control

• Passwords are hashed with bcrypt (per-user salt). We never store or log plaintext passwords.
• Passkeys (WebAuthn) let admins sign in with device biometrics or a hardware security key — phishing-resistant, and usable as a password alternative or second factor.
• Dashboard sessions use signed, expiring JWT tokens. "Remember me" is opt-in.
• SDK API keys are stored only as SHA-256 hashes — the plaintext is shown to you exactly once at creation. Keys are revocable instantly, can be bound to specific app ids, and carry device and monthly-event caps so a leaked key can't be abused.
• Password reset uses single-purpose, time-limited signed tokens delivered by email.

Multi-tenant isolation

GeofenceKit is multi-tenant by design. Every data request is bound to the caller's workspace, so customers are fully separated from one another. The platform operator can manage a customer's workspace only through an explicit, auditable "acting-as" scope — never silently. A customer's SDK key can only report events for that customer's own zones.

What location data we handle — and don't

We are built for data minimization. Your app's SDK evaluates geofences on the device and sends us only discrete events — an enter, exit, or dwell — not a continuous stream of coordinates.

Each event contains: the zone, a device identifier, an optional user id you choose to supply, a timestamp, the app id, and the platform. We do not require names, emails, or precise continuous location tracks, and we do not build advertising profiles or sell data — ever.

Consent is in your hands. Your application requests the OS location permissions and obtains any consent required by law from your end users. We act as your processor for that event data and as the controller only of your own account information.

Data ownership, retention & deletion

• You own your data. Export branches, campaigns, and analytics to CSV from the dashboard at any time.
• Automatic retention. Event and analytics data is deleted automatically after 90 days by a daily job.
• Deletion on request. Ask us and we'll delete your workspace and its data; suspended/closed workspaces are purged after a short grace period.

Infrastructure & subprocessors

We run on established cloud providers rather than our own servers. The core providers below maintain their own independent security programs; several hold SOC 2 Type II. We keep this list current — tell us if you need advance notice of changes.

Our infrastructure is currently hosted in the United States. If you have specific data-residency requirements, contact us to discuss.

Privacy & compliance posture

We designed the platform to help you meet obligations under regulations such as the GDPR and CCPA — through data minimization, defined retention, export/deletion tooling, and a clear processor/controller split. See our Privacy Policy and Terms of Service.

Honest status: GeofenceKit is an independent product and does not currently hold its own third-party certifications (e.g. SOC 2 or ISO 27001). We're glad to complete your security questionnaire and to sign a Data Processing Agreement (DPA) — just ask.

Reporting a vulnerability

Found a security issue? We appreciate responsible disclosure. Email support@geofencekit.com with steps to reproduce, and please give us reasonable time to remediate before any public disclosure. We won't pursue action against good-faith research that avoids privacy violations, data destruction, and service disruption.

Contact

Security & trust: support@geofencekit.com · General: support@geofencekit.com