Privacy

Who we are

This site, secondkeysecurity.com, is operated by Second Key Security, LLC.

What we collect

If you email us, we receive what you send: your email address, your name if you include it, and your message. We use it only to reply to you.

Booking a call

If you book an intro call, booking is handled by Google Calendar. What you enter there is used only to prepare for the call.

Page views

We count page views with Vercel Web Analytics, provided by our host. It sets no cookies and shows us totals only: which pages were viewed, the referring site, and the general type of device, browser, and country. We do not use it to identify you.

Framework request form

If you ask for the Unified AI Compliance & Assurance Framework (UACAF)™ through the request form, we collect what you enter: your first and last name, work email address, company, job title, and company size. We use it to email you the framework as a PDF and to follow up with you about it.

The form goes to our own site, which sends two emails through Resend, an email delivery service: the framework to you, and your request to our inbox. Our site does not keep a copy. Your AI governance check answers and score are never part of a request.

To block bots, the form uses hCaptcha to check that you are human. hCaptcha loads only when you reach the form, not when a page loads, and it handles what it collects for that check, such as your IP address and how you interact with the check, under its own privacy policy. Our site asks hCaptcha to confirm the check before it accepts a request. It is used only on our two request forms.

To have your request details deleted, email hello@secondkeysecurity.com.

Full assessment request form

If you ask for a full UACAF™ assessment through the request form, we collect what you enter: your organization name, your first and last name, work email address, company size, sector, whether you are a public or private organization, where you operate or sell, how you work with AI, the approximate number of AI systems, and, if you add it, what prompted the request. We use it to reply to you and to scope the assessment.

Like the framework request form, it goes to our own site, which sends two emails through Resend: a reply to you with a link to book a scoping call, and your request to our inbox. It uses hCaptcha in the same way. Your AI governance check answers and score are never part of a request.

To have your request details deleted, email hello@secondkeysecurity.com.

AI governance check

The AI governance check scores your answers in your own browser. Your answers and your score are never sent to us or to anyone else, and they are not saved: they are gone when you leave the page.

On that page we also count a few actions with Vercel Web Analytics: starting the check, finishing it (with the resulting level only: Starting, Developing, or Established), and selecting one of the next-step links. The PDF report is built in your browser too. On the UACAF™ page we count selections of its two links in the same way, each framework request and each full assessment request that is sent, and each workbook checkout that is started. These counts carry no answers and no personal data.

UACAF™ assessment

We don't store your assessment answers on our servers. They are encrypted in your browser and only Second Key Security reviewers can read them. Stripe processes workbook payments; Resend delivers email.

The full UACAF™ assessment is a private page for invited clients, opened with an access code. While you work, everything you enter stays on your device: your organization profile, your AI systems, and your answers and evidence descriptions.

When you submit, your browser encrypts your submission with our public key before anything is sent. Our site receives only the encrypted file and your access code, checks the code, and passes the encrypted file to our inbox through Resend. Our site keeps no copy, and neither our web host nor Resend can read the file. It can be opened only with a private key that our reviewers hold and that is never on our site.

When we approve your access, we email you a private link and an access code through Resend. The code is signed, and it holds a client ID, your engagement tier, and its expiry date. To open the assessment, the page sends the code to our site, which checks it and returns the assessment content. We do not log the code.

The page saves your progress in your own browser so you can come back to it. It uses two kinds of browser storage: local storage holds your saved answers until you clear them, and session storage holds your access code until you close the tab. Neither is a cookie. "Clear my data from this browser" removes both. You can also save your progress to a file on your device and load it on another computer.

After you submit, you can save a copy of your submission and a PDF record. Both are built in your browser and saved to your device; those copies are not encrypted.

On these pages we count three things with Vercel Web Analytics, as event names only: that an assessment was opened, that an assessment was submitted, and, on the reviewer page, that a review was finalized. These counts carry no answers, no evidence, no organization or system names, no scores, and no access codes.

Buying the workbook

If you buy the UACAF™ workbook, you enter your work email address on our site and pay on Stripe Checkout. Stripe processes the payment and collects your card details; we never see or store your card number. Stripe tells our site that the payment succeeded, and our site then emails the workbook to the address you gave, through Resend.

We keep the record of your purchase that Stripe holds for us: your email address, what you bought, and the amount. Our site keeps no copy.

What we do not do

• We use no other analytics, tracking, or tag tools.
• This site sets no cookies. Your light or dark theme choice is saved only in your own browser, and so is your progress in the UACAF™ assessment if you are an invited client.
• We show no ads.
• We do not sell personal data.

Hosting

The site is hosted by Vercel.

Contact

Questions about this notice go to hello@secondkeysecurity.com.