What we collect, why, and who can read it.

Who we are

27 TOOLS LLC, doing business as ShadowLatch.

ShadowLatch is operated by 27 TOOLS LLC, an Indiana limited liability company ("ShadowLatch", "we", "us"). This policy covers shadowlatch.com, the Manage console, the ShadowLatch apps for Windows, Linux, Android and ChromeOS, and our support. We sell to organizations in the United States.

Questions about privacy go to support@shadowlatch.com, where the people who build ShadowLatch answer.

Your data, your organization

Two roles, depending on whose information it is.

Information about our customers, such as the people who sign up, sign in and pay, is handled by us under this policy. We decide how it is used.

Information from managed devices belongs to the organization that installed ShadowLatch: a company, a managed service provider's client, a school. We process it on that organization's behalf and under its instructions, the way a service provider does, and only to run the service for it. Most of it is end-to-end encrypted so we can't read it at all.

If your computer, phone or Chromebook is managed by an employer or school, that organization decides what is monitored, who sees it and how long it is kept. Ask its administrator about its practices. Organizations must enroll only devices they are authorized to manage and give whatever notice their situation requires.

An organization can also hand its account to an IT provider (a managed service provider) that uses ShadowLatch. Once the account's owner accepts, the provider runs the account for the organization: it can see the organization's data, including end-to-end encrypted data, and handles its billing. The provider can hand the account back at any time, and if it doesn't within 14 days of the owner asking, we can.

Account information

What we collect about customers.

Account and team

Name, email address, company name, role, and the plan and number of devices. Passwords are stored only as a one-way hash. Second-factor secrets are encrypted. For passkeys we store only the public key.

Sign-in and security records

When you sign in we record the time, IP address and browser type, and keep a list of active sessions and trusted browsers you can review and revoke. The audit log records changes administrators make to policies, devices and users.

Billing

Card payments are taken by our payment provider, Stripe, on its own pages. We never see or store card numbers. We keep the subscription, plan, billing name and company, and payment status Stripe reports to us.

IT provider logos

An IT provider can upload its logo (PNG or JPEG, up to 256 KB) to show on its clients' alert and report emails. We keep the current logo and one earlier one so it can be put back, and delete anything older as soon as a new logo is uploaded. Logos are served at a public address so email apps can show them.

Beta requests

What you enter on the beta form, plus the time, your IP address and browser type to prevent abuse.

Support and feedback

What you send us by email or through Feedback in the console, including screenshots or recordings you choose to attach. Feedback is delivered to our support mailbox. The console keeps only a short record of it (who sent it and when), not the attachments. Never send passwords, recovery kits or enrollment codes.

Managed devices

Connection details, not content.

The ShadowLatch app records network activity on the devices an organization enrolls. Depending on the platform and the organization's settings, a record can include:

• the program or app that made the connection (on Windows and Linux its path and the signed-in user name; on Android and ChromeOS the app's package name);
• the website or service name, from the DNS lookup or the connection itself;
• the remote IP address, port and protocol, the amount of data sent and received, the time, and whether it was allowed or blocked and by which policy;
• on devices with intruder blocking, the addresses that tried to sign in or scan the device, and why they were blocked;
• device details and health: device name, operating system and app version, a device identifier, upload status and errors.

What ShadowLatch doesn't collect: the content of web pages, messages or files, full web addresses (URLs), form entries, passwords, keystrokes, screenshots or location. It doesn't decrypt HTTPS. Traffic goes straight from the device to its destination and never passes through our servers.

On the device. The app keeps a local copy of recent activity, capped in size, and a queue of records waiting to upload. Uninstalling removes them.

Patterns (optional). An organization can set patterns that watch for a sequence of activity on a device, such as visiting a banking site and then starting a remote-support tool, and respond by warning the person on screen, blocking connections or emailing the people the organization chose. The pattern is checked on the device. When one matches, the device reports which pattern it was, the kinds of steps, the categories and the remote-support tools involved, and the time. It never reports the names of the sites visited. Pattern names and warning messages the organization writes are encrypted like other identifying details. Reports are deleted after 90 days; a block that hasn't been released yet is kept until it is.

Removal protection (optional). When an organization turns it on, removing ShadowLatch from a device needs a removal code or the organization's approval in Manage. Codes are made in the administrators' browsers and stored encrypted so that only they can read them; viewing a code is recorded in the audit log. The device reports wrong codes, removals and attempts to stop the app, with the time and the kind of attempt, so the organization can be alerted. These reports are deleted after 90 days.

Diagnostics you send (optional). When something isn't working, a person using a device can choose Send diagnostics, and an organization's owner or administrators can request diagnostics from one of its devices. Each time, before anything is sent, the person sending or the administrator requesting sees what the file contains and must confirm. A diagnostics file holds the ShadowLatch app's own logs from the last 24 hours, its settings, version, health and update status, crash reports, and an optional note written by the person sending it. Before the file leaves the device, public website names and public IP addresses are replaced with placeholders, and the computer name, user names, email addresses and device identifiers are removed. It never contains activity records, the websites the device looked up, files, encryption keys or passwords. The file is stored on our servers, where the organization's owner and administrators can download it, and each download is recorded in the audit log. ShadowLatch support may open it to fix the problem, and the note is readable to us. An organization can also turn on automatic diagnostics, which is off by default: the app then sends a smaller file on its own after a crash or a failed update. Diagnostics files are deleted after 30 days.

DNS. The app answers the device's DNS lookups itself so it can apply the organization's policies. It forwards them to the DNS servers the device already uses, or to an encrypted DNS provider the organization picks, such as Cloudflare, Quad9, Google or its own servers. That provider then sees the lookups under its own privacy terms. ShadowLatch doesn't run a DNS service and never sees lookups in readable form.

End-to-end encryption

Most device data is unreadable to us.

Program and app names, website names, user names, device names and other identifying details are encrypted on the device before upload, to a key that only the organization's administrators hold. They are decrypted only in their browsers. ShadowLatch has no copy of that key and no master key, so we can't read this information, and neither could anyone who broke into our servers, except for device names when an organization turns on device names in alerts (below).

The service can read what it needs to work: remote IP addresses, ports and protocols, allowed or blocked, data amounts, times, and device and account identifiers. It can also read what a policy targets, because it compiles and signs policies for devices. Two short labels the app attaches to a connection are readable too, so Review can point them out: the rating of the website name (such as Known bad or Newly registered), and whether the program is a remote shell tool such as SSH or PuTTY. The label says only that; the program and the website name themselves stay encrypted. Organizations can turn on Maximum privacy to encrypt remote IP addresses too. The Data & controls page lists every field.

Device names in alerts (optional). An organization's administrator can choose to show device names in alert emails and notifications. It's off unless they turn it on, which requires signing in with a second factor. While it's on, device names, and only device names, are also encrypted to a separate key that our servers hold. We use that key only to put a device's name into the alerts the organization has set up, and never store or log the names in readable form. That key can't open anything else: program and app names, website names, user names and other identifying details stay encrypted to the organization's own key, which we never have. The email provider that delivers an alert sees the device name in it. Turning the setting off deletes that key and every copy of the names encrypted to it right away; copies in our encrypted backups are gone within 30 days. Changes to this setting are recorded in the audit log.

How we use information

To run the service, and nothing else.

• to provide ShadowLatch: show activity, enforce policies, send the alerts an organization sets up, and keep devices up to date;
• to manage accounts, billing, sign-in security and support;
• to keep the service secure and working: prevent abuse, fix problems and investigate incidents;
• to send service emails, such as sign-in codes, alerts, monthly reports to managed service providers, receipts and important changes. We don't send marketing email without permission;
• to meet legal obligations.

We don't sell personal information, share it for targeted advertising, or show ads. We don't build profiles of people and don't use customer or device data to train AI models.

Shared intruder list. On plans that include it, organizations can opt in to a shared list of attacking addresses. An address joins only after it has been blocked in at least two participating accounts. Only the attacking address is shared, never anything about the organizations or their devices.

Who else handles it

A short list of service providers.

We use these providers to run ShadowLatch. Each gets only what its job needs. Our servers and backups are in the United States.

Optional IP details. If an organization turns on IP details (off by default), the service sends public IP addresses, and nothing else, to ipapi.co, iplocation.net or ipinfo.io to look up the owner and approximate location.

Destinations you choose. Alert emails, webhooks and exports go where an organization sends them, under its control.

Legal reasons and business changes. We disclose information when the law requires it, after checking that the request is valid, and we tell the affected organization unless we're not allowed to. End-to-end encrypted data stays unreadable even then. If ShadowLatch is sold or merged, this policy continues to apply to the information transferred.

Lists of known-bad sites, threat feeds and similar data are downloaded to our servers. We send nothing about customers to get them.

How long we keep it

Only as long as it's needed.

Device activity

30, 90 or 180 days, depending on the plan, then deleted on a rolling basis. Removing a device deletes its activity right away.

Account information

While the account is open. When the owner deletes the account (Account page) everything belonging to it is removed from our live systems right away, including its devices, activity, policies and audit log, and any subscription is canceled.

Backups

Encrypted daily backups are kept for 30 days, so deleted information is gone from backups within 30 days.

Billing records

As long as tax and accounting law requires. Stripe keeps its own records under its terms.

Security logs

Web server logs are kept for 14 days and other server logs for 30 days.

Pattern matches

Deleted after 90 days. A block that hasn't been released is kept until it is released.

Removal protection reports

Deleted after 90 days.

Diagnostics files

Deleted 30 days after they arrive.

Feedback, beta requests and support email

Feedback records are deleted after 180 days. Beta requests and support email are kept while they're useful, and deleted on request.

Schools and students

Student data stays the school's.

When a school or district uses ShadowLatch, for example on student Chromebooks, it does so under its own policies, and these commitments apply:

• We act as a service provider under the school's direct control. Under FERPA we act as a "school official" with a legitimate educational interest, and use student information only to provide ShadowLatch to that school.
• We never sell student information, use it for advertising, or build profiles of students for any purpose other than the school's own use of the service.
• For students under 13, the school gives consent on behalf of parents for this educational use, as COPPA allows. We collect only what the service needs.
• The school can see, correct and delete student information at any time in the console. When it removes devices, deletes its account or asks us, we delete student information within the times above.
• Parents and students should send requests to their school, which controls the data. If they contact us, we'll pass the request on to the school.

ShadowLatch isn't a consumer service for children. Children can't sign up for an account.

Your choices and rights

See it, fix it, take it, delete it.

Account owners and administrators can see and change account information in the console, export activity, remove devices and delete the account themselves. You can also email support@shadowlatch.com to:

• find out what personal information we hold about you and get a copy;
• correct it;
• delete it;
• ask questions or complain.

We'll confirm your identity first, usually through your account, and reply within 45 days. If we turn down a request you can appeal by replying to our answer, and we'll reply to the appeal within 60 days. If you're still unhappy, you can contact your state attorney general. We won't treat you differently for using these rights.

For information from a managed device, we act for the organization that manages it, so we'll refer your request to it, and help it respond.

Security

Built so a breach reveals as little as possible.

Identifying device data is end-to-end encrypted. Everything travels over HTTPS, and devices check our server's identity. Backups are encrypted to a key kept off our servers, the long-term activity store sits on an encrypted disk, and second-factor secrets are encrypted. Administrators sign in with a second factor or passkey, and sensitive actions ask for it again. The Security page has more detail.

No system is perfectly secure. If a breach affects your information, we'll tell affected customers without undue delay, as the law requires.

Website and cookies

No tracking, no ads.

shadowlatch.com and the console use no analytics, advertising or tracking cookies, and no third-party trackers. Browser storage is used only to keep you signed in, remember a browser you've trusted for sign-in, and remember settings such as light or dark mode. Data & controls lists the items. Because we don't track you across websites, browser "Do Not Track" and Global Privacy Control signals change nothing here.

Changes and contact

We'll tell you before anything important changes.

When we update this policy we change the effective date above. For a material change we email account owners before it takes effect. We won't use information collected earlier in a materially different way without consent.

Contact: support@shadowlatch.com. 27 TOOLS LLC, doing business as ShadowLatch, Indiana, USA.