Skip to main content
How Kordless handles your data, what is preserved, and what happens when you pause or revoke access.

​
Data ownership

Your Book, Quotes, Commitments, and settings belong to your workspace. Kordless does not use your pricing data to train models or sell it to third parties.

​
What Kordless stores

  • Book sources — the files, text, and explanations you provide to draft your Book
  • Statements — the verified pricing and policy rules
  • Calibration cases — representative and boundary scenarios with outcomes
  • Book versions — immutable published editions
  • Quote records — inputs, derivation, conditions, and review state
  • Commitment records — accepted offers with hold, booking, and deposit state
  • Request logs — API request metadata (no request bodies or secrets)
  • Settings — business facts, quote handling, and connection configuration

​
What Kordless does not store

  • Full request or response payloads in API logs
  • Plaintext API keys (only hashes)
  • Payment card numbers (handled by the billing provider)
  • Customer credentials

​
Test and Live data isolation

Test and Live data are fully isolated. Test operations cannot read or write Live data, and vice versa. Each environment has its own:
  • Keys and credentials
  • Book draft workspaces (Test) and published versions (Live)
  • Quote records
  • Request logs

​
Pause and resume

When Live use is paused:
  • Your Book is preserved — not deleted
  • Your quote history is preserved
  • Your settings are preserved
  • Your workspace stays accessible — you can review everything
  • The runtime is switched off — no new Quotes are produced or committed
  • Reactivation restores full operation
Pausing does not delete your Book or history. Do not pause as a way to clear data — it preserves everything.

​
Source files

Files you upload to draft your Book are stored in private Supabase Storage. The upload path is derived from trusted route context — the route never accepts an arbitrary bucket or path from the client. Files are used for extraction and provenance; they are not exposed publicly.

​
Request logs

API request logs record:
  • Request ID
  • HTTP status
  • Path and method
  • Environment (Test or Live)
  • Timestamp
Logs do not contain:
  • Request bodies
  • Response bodies
  • API key secrets
  • Customer data

​
Credentials

API keys are reveal-once: the plaintext exists only in the response to a mint or roll operation. After that, only the key’s hash is stored. You must copy a new key before dismissing the panel — it cannot be shown again. Webhook signing secrets are also reveal-once.

​
Revoking access

When a connected-Account connection is revoked:
  • The connection is severed immediately
  • The connected Account’s data is not deleted from the Account owner’s workspace
  • Your workspace loses access to the connected Account’s Book, Quotes, and settings
  • Any active integrations using your credentials for that Account stop working

​
Data retention

  • Active workspace data is retained while the subscription is active
  • Paused workspace data is retained while the Pause subscription is active
  • Past-due or canceled subscriptions preserve data during a grace period, then it may be removed
  • Enterprise tiers may negotiate custom retention terms

Usage and billing

Understand active Book billing, plans, and usage.