Legal
Last updated October 17, 2026
Myrikeep is a service that finds and classifies sensitive data at rest for small businesses and homelabbers. Myrikeep is provided by Covered On LLC. For anything privacy or legal, email [email protected]; to report a security issue, see the Security page.
Myrikeep is agent-first: you run our scanning agent inside your environment (your server, container or network). Your files, mail and other data are read and classified inside the agent. The console only receives the results of a scan — labels, counts, locations, metadata, exposure facts and statistics. File contents are not sent to us or stored by us, with one narrow, opt-in exception described under “Optional AI assist”.
Everything the agent sends back fits into these categories:
The mail connectors (IMAP, Gmail, Microsoft 365) read what classification needs, inside the agent: header fields (sender and recipient addresses, subjects, dates) and supported attachments. The IMAP connector never reads message bodies. The Gmail and Microsoft 365 connectors do read message text to classify it, but only inside the agent — message text never leaves the agent. What we store server-side for mail is the locator, mailbox and folder, sender address, received date, a masked subject truncated to 160 characters, Message-ID and attachment file names — never message bodies or file contents.
For agents you run, connector credentials stay on the agent, in its secrets directory — they are never uploaded to us. If you choose our hosted scanning for an SMB, S3, Azure Blob or IMAP connection, that connection’s read-only credential is stored on our server encrypted at rest and delivered to the scanning agent for the scan. Microsoft 365, Google Workspace, personal-drive and local-folder credentials always stay in your agent, whichever mode you use.
AI assist is off by default and is switched on per workspace by an administrator. When it is on, a short snippet of a file the local rules could not label — capped by your workspace setting (800 characters by default) — is sent once to our AI provider, OpenRouter, to suggest a label. Every part of the snippet that matched a known sensitive pattern is masked before it leaves the agent. Snippet text is never written to our database or logs; the audit trail records counts only. Turning AI assist off is enforced by the server and stops snippet delivery immediately. OpenRouter is a subprocessor only when this feature is enabled.
Test Drive lets you try Myrikeep on sample files (up to 500 MB across your upload) without an account. The files are scanned on our server by a dedicated agent that has read-only access to the upload, and are permanently deleted right after the scan — also if it fails or you cancel. We email you when they are gone. The results (labels, counts and a risk score) and your email address are kept for 24 hours and then deleted. Your email is used only to send your upload link and the results; your IP address is used transiently to rate-limit requests and is not stored.
An account holds your email address, your name and a password hash (we never store your password in readable form). Accounts belong to workspaces; workspace members and invitations are managed by the workspace owner. We use only essential cookies: a sign-in session cookie, a CSRF-protection cookie and a language cookie, plus a theme (light/dark) preference stored in your browser. We do not use analytics or advertising cookies. When you sign up or use the Test Drive, a Cloudflare Turnstile bot check may run.
We send only transactional email (invitations, sign-in and confirmation mail, Test Drive links and deletion receipts) from [email protected], via Google Workspace. There are no marketing emails.
These providers process data on our behalf so the service can run:
There is no payment processor: Myrikeep is free during the pilot.
Scan results (findings, locators, metadata, statistics) and the audit log are kept until they are deleted, so your history stays available across scans. Test Drive data is wiped automatically as described above. There is no self-serve workspace deletion yet — to delete your workspace, account or their data, email [email protected] and we will do it for you. We keep nightly server backups for recovery (about two weeks); deleted data ages out of backups as they rotate.
Traffic to and from Myrikeep is encrypted with TLS. Connector credentials we hold for hosted scanning are encrypted at rest. Agents use read-only access where the source supports it. For more detail, see the Security page. We do not hold third-party security certifications.
Whoever you are — an individual, a homelabber or a business — you can ask to access, correct, delete or export your personal data, and object to our processing of it. Email [email protected] and we will respond within 30 days. These rights include those known as GDPR (EU/UK) and CCPA (California) rights. If you use Myrikeep for a business, you are the controller for data in the systems you scan, we act as a processor for the results, and we will sign a data processing agreement on request.
Myrikeep is not directed to anyone under 16, and we do not knowingly collect their personal data.
If we change this policy we post the new version on this page with a new “last updated” date. For material changes we also email account holders.
Questions or requests? Email [email protected]. Security reports go to the same address (see the Security page).