Your data: storage, encryption, export and deletion

Where it lives

In the EU. The database, the file storage and the services around them are all EU-hosted, which is a deliberate choice rather than a coincidence, and it is why a German freelancer can use this without a separate conversation about transfers.

What is encrypted

Files are encrypted at rest. Every file in the store carries the note, and somebody with access to the underlying storage sees ciphertext rather than your contracts. See Storage and encryption.

Credentials for connected services (mailboxes, sync passwords) are stored with envelope encryption rather than in a readable form.

Passwords are hashed, not encrypted, which is the correct treatment: they cannot be recovered by anybody, us included.

What that protects, and what it does not

It protects against the infrastructure being read: a stolen disk, a misconfigured store, a provider-side incident.

It does not protect against somebody signed in as you. That is what your password, the sessions list and reviewing who is on your team are for.

Getting your data out

One button gives you all of it: Download my data, in settings under Your security. It builds a ZIP for each team you own, and in it are:

• every file and attachment, decrypted
• one JSON file per table for the records behind them: contacts and their addresses, phone numbers and emails, organizations, projects, tasks, activities, employees, time entries, invoices with their line items, trips, expenses, CVs, the audit log and more
• a manifest.json listing a SHA-256 checksum for every file, so you can check the archive arrived intact

What it leaves out is credentials and our own bookkeeping: API key and sync password hashes, the encrypted mailbox secrets, sync tombstones, raw payment webhooks. None of that is content you made, and the hashes are worth nothing to you or anybody else.

One thing to know before you press it: only teams you own count. If you are a member of somebody else's team rather than its owner, that button returns an empty ZIP, and the export you want is the owner's to make.

For a single kind of record the narrower exports are still there, when that beats opening a whole archive:

The API is for the ongoing case rather than the one-off. It reads organizations, contacts, projects, employees, CVs and more, and an API key with read scopes is enough.

Deletion

Deleting a record in the product deletes it. Where that would destroy something you are legally required to keep, Steerd does not offer the deletion at all, which is why generated documents cannot be deleted and an issued invoice can only be corrected.

That is not a limitation to work around. An invoice you can make disappear is an invoice that proves nothing.