Trust & security
Dedicated resourcesfor every workspace.
Keep gives each workspace dedicated application resources on Cloudflare, with access scoped to the people and agents you authorize.
Your workspace
- Dedicated database
- Separate file storage
- Scoped access
Separate storagefor each workspace.
Each Keep workspace is provisioned with its own Cloudflare D1 database, R2 storage bucket and tenant Worker. The Worker’s resource bindings point to that workspace’s database and files.
That separation gives your project records and uploaded artifacts a tenant-specific storage boundary. Shared Keep services handle identity, routing, administration and operational telemetry.
“Dedicated” describes these application resources. They run on Cloudflare’s shared infrastructure; it does not mean a dedicated physical server or a separate Cloudflare account.
Access controlfor people and agents.
Membership and project permissions
Workspace membership and project roles determine access to records and actions. Connecting an agent does not make it a workspace administrator; its requests remain subject to the user’s permissions.
Connections you can revoke
AI clients connect through an authorization flow. Keep checks current workspace membership on agent requests. Each connection is listed on My profile › Connections, and revoking it there removes its access to every workspace immediately.
Authorized tools can return project information to your connected AI client. That provider’s handling of the returned data is governed by your settings and agreement with it.
Approval by role, recorded with its channel
Whether a decision, an update or a share link takes effect immediately is determined by the person’s role, in the application and through a connected assistant alike. Every approval, rejection, direct write and staged item records its channel: the application, an assistant or the system.
Code Mode under the same checks
In Code Mode, an assistant’s script calls Keep’s tools one at a time, and each call passes the same membership, permission and rate checks as a direct call. Consequential actions, such as approvals, deletions, sharing and changes to members, are never part of a script.
Deliberate sharing
Artifact share links can carry a password and expiry, and can be revoked. An artifact must be marked shared first. A public share link lets its recipient read it without a Keep login. A link that a project manager, the project owner or a workspace administrator creates takes effect immediately; a member’s link waits in the Queue for approval (in a vault, by the vault owner or a workspace administrator). Only a project manager, the project owner or a workspace administrator may remove a link’s password. Embedded Google Docs retain their Google permissions.
Encryption for stored data
Cloudflare documents automatic AES-256 encryption at rest for D1 databases and R2 objects, with keys managed by Cloudflare. Its documentation also describes TLS protection for D1 transfers and client connections to R2.
Built on Cloudflare,configured per workspace.
Keep brings compute and storage together on Cloudflare’s developer platform. The tenant model uses these services together, with resource bindings configured for each workspace.
Workers for Platforms
Runs the tenant Worker in Cloudflare’s isolated execution environment.
D1
Stores the workspace’s structured project records in its dedicated database. The workspace’s creator selects the database’s data region.
Cloudflare’s platform security and compliance materials describe Cloudflare’s services. They are not a separate certification of Keep.
Visit Cloudflare’s Trust HubDurable storageand record recovery.
Keep runs on Cloudflare’s Workers platform and managed storage services. Application availability also depends on Keep, authentication and the underlying services; an incident in a dependency can affect access.
A Keep-specific uptime SLA is not published. Cloudflare’s service commitments and status describe its platform, rather than end-to-end Keep availability.
View Cloudflare’s platform statusDurable object storage
R2 uses replication or erasure coding and storage across multiple data centers within a region to protect against hardware failures. Durability protects stored data; it is a different measure from service uptime.
A way to recover
Keep’s recycle bin retains deleted records for 30 days unless an authorized owner permanently deletes them earlier.
Separately, D1 provides infrastructure-level point-in-time recovery through Time Travel, with retention depending on the Cloudflare plan. This is distinct from Keep’s record-level restore.
Free trial · 14 days
Bring a real project.
Bring your team and your AI agents into one shared workspace. Sign in to your workspace or start a free trial.
Security questions
Talk to the Keep team
Ask about tenancy, data handling or availability before bringing your team’s work into Keep.
Information reviewed 22 November 2026.Read our privacy information