Privacy policy

In short

On Mac and iPad, KeyHole works without an account and without any VigilanceX server: your hosts, keys and sessions stay on your Mac or iPad. The app collects no personal data and embeds no analytics. The only outbound connections go to Apple (App Store), to the servers you administer yourself and, if you use a licence key, to our revocation list. The website sets no cookies.

MSKeyHole, the Windows edition, is a separate app: its processing is described in the “MSKeyHole (Windows)” section below.

Data controller

IT-SECURE Luxembourg S.à r.l. (VigilanceX and HostCitadel brands), 87, Route d'Esch, L-4450 Belvaux, Grand Duchy of Luxembourg, RCS Luxembourg B174255. Contact for any question about personal data: contact@vigilancex.io. Given the nature and volume of the processing, no data protection officer has been appointed.

This document applies to the KeyHole app for macOS (Mac App Store version and direct download version) and for iPadOS (App Store version), to the MSKeyHole app for Windows (“MSKeyHole (Windows)” section) and to the website keyhole.vigilancex.io. It is drawn up in accordance with Regulation (EU) 2016/679 (GDPR) and the Luxembourg law of 1 August 2018.

Data processed by the app (Mac and iPad)

Everything stays local. Hosts (names, addresses, ports, login identifiers, groups, icons, notes), preferences and usage history are saved in the app's data folder on your Mac or iPad. Passwords and passphrases are stored in the macOS or iPadOS Keychain, encrypted by the system, and only leave it to establish the connection you request. SSH private keys are never copied: the app reads the file you point it to. On iPad, files downloaded over SFTP are saved in the Files app (On My iPad › KeyHole).

No account, no sync, no telemetry. KeyHole does not require a user account, synchronises nothing to any online service and sends no usage statistics or automatic crash reports to IT-SECURE Luxembourg.

Logs. A technical log is written to ~/Library/Logs/KeyHole on your Mac. It may contain host names and user names, never passwords. It only leaves your Mac if you send it yourself (see "Support and problem reporting").

Session recordings. When you enable recording, the terminal transcript (Markdown) or the RDP session video is written to Documents/KeyHole records (direct download version) or Downloads/KeyHole records (Mac App Store version). These files may contain sensitive information from remote systems; you are solely responsible for them and they only leave your Mac if you share them.

Network connections made by the app (Mac and iPad)

KeyHole only establishes the following connections:

• To your own servers (SSH, SFTP, RDP): the data exchanged travels directly between your Mac or iPad and the machines you have configured, encrypted by the respective protocols. IT-SECURE Luxembourg has no access to it.
• To Apple: verification of purchase entitlements (StoreKit) and update checks through the public App Store API, which receives the app identifier. These exchanges are governed by Apple's privacy policy.
• To keyhole.vigilancex.io, only if a licence key is configured: download, at most once every twelve hours, of a signed revocation list containing opaque key identifiers. No personal data is sent; as with any web request, the IP address is visible to the server and appears in its technical logs (see "Website").

MSKeyHole (Windows)

The previous sections describe KeyHole for Mac and iPad. MSKeyHole, the Windows edition, processes data as follows.

• Data stored on your PC. Hosts, credentials and keys are saved locally on your PC, in an encrypted vault unlocked by a YubiKey or another FIDO2 security key, by Windows Hello or by a master password. They are not transmitted to IT-SECURE Luxembourg.
• Activation. MSKeyHole is activated with your e-mail address through the service https://keyhole.vigilancex.io/api/mskeyhole/v1/, operated by IT-SECURE Luxembourg. The app then sends the installation identifier (computed from your PC's TPM chip) and your PC's public signing key (the private key never leaves the PC), the e-mail address entered, the app and Windows versions, and the language. An e-mail containing an activation link valid for 24 hours is sent to you. The app then regularly renews its activation token, valid for 30 days. The service records this data, the dates of first and last contact, a prefix of your IP address (its first three numbers, never the full address) and the history of operations (activation, licence, updates), to manage your licence, prevent abuse (licence sharing, modified copies) and assist you. Legal basis: performance of the contract and legitimate interest (abuse prevention).
• Information e-mails (optional). During activation, the app asks whether you agree to receive information e-mails. Your choice, its date and the version of the text shown are recorded. You can withdraw your consent at any time by writing to contact@vigilancex.io. Legal basis: consent.
• Session recordings. MP4 videos of the sessions you record are stored locally on your PC. They may contain sensitive information from remote systems; you are solely responsible for them and they only leave your PC if you share them.
• Revocation list. When a licence key is entered, the app downloads the signed revocation list https://keyhole.vigilancex.io/revoked.json every twelve hours; it contains only key identifiers.
• Updates. The app only checks for an update when you click “Check” (« Rechercher ») in Settings › System (Réglages › Système): it then queries the service https://keyhole.vigilancex.io/api/mskeyhole/v1/ with its installation identifier and version and, if you update, downloads the new package through a temporary link. These requests are recorded (date, versions, IP prefix).
• Download request. MSKeyHole is downloaded through a personal link sent by e-mail from the Windows page. Your e-mail address, the date, the version requested, the number of downloads of the link and a prefix of your IP address (its first three numbers) are recorded to send you the link, prevent abuse and follow trials of the app; if you then activate MSKeyHole with the same address, the request is matched with your installation. The link is valid for 24 hours. Legal basis: pre-contractual steps taken at your request and legitimate interest (abuse prevention).
• Hosting logs. These downloads, like visits to the website, go through the hosting infrastructure of IT-SECURE Luxembourg (HostCitadel), whose servers keep technical logs (IP address, date, requested file) for a limited period necessary for security. Legal basis: legitimate interest.
• Artificial intelligence (optional). Only if you configure it. What the sessions you entrust to the AI display is sent to the provider you chose (Anthropic, OpenAI or Mistral AI), with your own API key, under that provider's terms of use and privacy policy. IT-SECURE Luxembourg receives nothing from these exchanges. Passwords are never sent to the AI. MCP clients (for example Claude Desktop or Claude Code) are local apps, paired with MSKeyHole by a revocable token.
• Licences. MSKeyHole licences are sold by IT-SECURE Luxembourg, not by Apple; they are separate from App Store purchases. When you enter a licence key, or support assigns it to your installation, the licence identifier is linked to the installation identifier to count the authorised seats. The key is kept encrypted by the service, only to be returned to that installation, and erased when the licence is removed from the PC.

Purchases and subscriptions (Mac and iPad)

The free version, KeyHole Pro subscriptions and the perpetual licence are sold by Apple through the App Store. Apple handles payment, invoicing, renewal and cancellation; IT-SECURE Luxembourg receives neither banking data nor the buyer's identity, only aggregated sales data. The app reads your purchase status locally to enable the corresponding features.

Licence keys issued directly

For licences issued outside the App Store (businesses, resellers), the key contains the holder's name and e-mail address as well as an identifier. This data is used to identify the licence holder and to revoke the licence in case of abuse. It is kept by IT-SECURE Luxembourg for the duration of the licence, then for five years under accounting obligations. The published revocation list contains only key identifiers, with no personal data. Legal basis: performance of the contract.

Support and problem reporting

The app's "Report a problem" feature prepares an e-mail in your mail client; nothing is sent without your action. The message contains your description, optionally your e-mail address, the app and macOS versions and, if you chose to include it, a diagnostic file (log excerpt and any crash report) that may mention host names and user names. Check its content before sending.

These e-mails and the website contact form are used exclusively to reply to you and to fix the reported defects. They are kept for twelve months after the request is closed, then deleted. Legal basis: legitimate interest (support and product improvement) and, for customers, performance of the contract.

Website

The website keyhole.vigilancex.io sets no cookies and embeds no tracker, no external font and no audience measurement tool. The hosting provider (HostCitadel, a brand of IT-SECURE Luxembourg, infrastructure in France) keeps technical connection logs (IP address, requested page, timestamp, browser) for a maximum of twelve months, for security and abuse detection purposes. Legal basis: legitimate interest.

Retention periods

Recipients and transfers

The only recipients of data are Apple (purchases, App Store), the hosting provider of the website and of the activation service, a brand of IT-SECURE Luxembourg, whose infrastructure is located in the European Union, and Microsoft (Microsoft 365), processor for sending MSKeyHole's activation and download e-mails, which processes them in its European Union data centres. No data is sold, rented or shared for advertising purposes. IT-SECURE Luxembourg makes no transfer outside the European Union; processing carried out by Apple is governed by Apple's own policy.

For MSKeyHole, if you enable the AI, the provider you choose (Anthropic, OpenAI or Mistral AI) receives the content of the sessions you entrust to it directly from your PC; this processing is governed by that provider's policy, which may involve processing outside the European Union.

Your rights

You have the right to access, rectify, erase, restrict, object to and port the data concerning you, as well as the right to set directives on what happens to your data after your death. To exercise these rights, write to contact@vigilancex.io stating the purpose of your request; you will receive a reply within one month. For data stored only on your Mac, iPad or PC, you can view and delete it directly.

If you believe your rights are not being respected, you may lodge a complaint with the Commission nationale pour la protection des données (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg, cnpd.public.lu, or with the supervisory authority of your country of residence.

Security

The app relies on macOS and iPadOS security mechanisms: encrypted Keychain, locking with Touch ID, Face ID or password, sandbox for the App Store version, SSH host key verification and TLS fingerprint pinning for RDP servers. Communications with Apple and keyhole.vigilancex.io are encrypted (TLS). On Windows, MSKeyHole protects its data with an encrypted vault (YubiKey or FIDO2 key, Windows Hello, master password), locks automatically after inactivity, when the Windows session is locked and on sleep, and clears a copied password from the clipboard after 30 seconds. No measure guarantees absolute security: keep your backups and secrets carefully.

Minors

KeyHole is a professional tool intended for administrators and developers; it is not aimed at persons under sixteen and does not knowingly collect any data about them.

Changes

This policy may be updated to reflect changes to the app or to regulations. The date of the last update appears at the top of the page; substantial changes are announced in the app's release notes.