Keyholder Privacy Statement

Keyholder is software that Fulkerson Advisors LLC builds and runs for business acquisitions. When a company changes hands, much of what it depends on is known only to the departing owner and a few employees. With the company’s approval, Keyholder reads its Microsoft 365 mail to find that knowledge. From it, Keyholder builds a map of the outside companies the company deals with and a set of facts, each tied to its evidence and checked by a person, for the buyer’s team to read.

This statement covers Keyholder only. Today Keyholder reads one source, the company’s Microsoft 365. Visits to this website, our newsletter and calls booked with us are covered by our website privacy policy.

In this statement, the client is the company that engages us under a signed engagement agreement and approves Keyholder’s access to its Microsoft 365. The client controls its mail and decides what Keyholder may read. Fulkerson Advisors processes that content on the client’s behalf, only to carry out the engagement and under the engagement agreement. Where this statement and the agreement differ, the agreement governs.

Keyholder never asks for a password. The client’s Microsoft 365 administrator approves the Keyholder app on Microsoft’s own consent screen. The permissions approved there let Keyholder read user profiles and the organization’s details, and Keyholder uses them only for the directory details listed below. Mail access is granted separately, in Exchange Online, by a setup script we provide: header access in every mailbox, and body access only in the mailboxes the client approves. The administrator can see each grant there and remove it at any time.

Keyholder reads Microsoft 365 through Microsoft Graph, and only what those grants allow.

• The directory: each user's name, email addresses and whether the account is active, and the organization's verified domains. Keyholder uses these to list the mailboxes and to tell the company's own people from outside ones.
• Message headers in the company's user, shared, room and equipment mailboxes: sender, recipients, date, subject and the technical header lines. Keyholder uses them to count who at the company writes to which outside companies, how often and since when, and to decide which threads to keep.
• Message bodies, only in the mailboxes the client approves, and only after the client records the date that mailbox's people were told. Keyholder reads the text of a message, not its attachments.
• Setup records from the client: the mailbox list its administrator exports, the dates holds were placed, counsel's list, and a copy of the notice given to employees.

For people who sign in to Keyholder, we keep their name and work email address from their Microsoft sign-in, the public key of their passkey where they have one, when each session began and ended, and an audit log of what they did in each workspace.

Keyholder does not read message bodies in mailboxes the client has not approved, and Microsoft will not return them. In an approved mailbox it reads no body until the client has recorded that the mailbox’s people were told and the date of that notice has passed.

Before collection starts, the owner’s deal counsel and the buyer’s counsel give us the addresses, domains and people whose mail must stay out. Keyholder checks each header against that list as it arrives. Matching threads are never stored, and their bodies are never fetched. Their headers pass through memory once, for that check, and are then dropped. If counsel adds to the list later, Keyholder erases what it already holds from that mail.

Keyholder’s screening model also flags threads whose headers suggest legal advice but that are not on counsel’s list. Each one is held. While it is held, Keyholder fetches none of its bodies, and any fact already drawn from the thread is hidden from everyone, our own staff included, who see only how many facts are held. Counsel decides. If counsel finds the thread privileged, Keyholder erases it and every fact drawn from it. Otherwise the hold lifts.

Screening sets aside personal, medical and marketing mail. Keyholder never fetches the bodies of set-aside threads, and no one at Fulkerson Advisors reads them. The log of set-aside mail keeps only counts and reasons. If a body that was fetched turns out to be privileged or personal, it is erased as section 08 describes.

Two AI models do the screening and extraction. Jev, a model made by TypeSafe, makes judgments: whether to keep a thread or set it aside from its headers, whether the headers suggest legal advice, and, for kept mail, what kind of fact a passage states and whom it rests on. Clairic, a model on Cloudflare Workers AI, finds and copies the exact passages a fact rests on.

We reach Jev through OpenRouter. Every request is pinned to one version of Jev and tells OpenRouter to send it only to a provider that retains none of the data, with no fallback to any other provider, so a request that cannot be served that way fails. Before Keyholder sends any mail to Jev, our OpenRouter account has zero data retention switched on and prompt logging switched off, and Keyholder sends nothing until that is checked. Clairic runs inside the Cloudflare account that hosts the rest of Keyholder and is called directly, with no logging gateway in between. Each model call records which model and provider answered it.

The models do not write the facts. Each fact is a sentence from a fixed template, filled with words Clairic copied from the source, so every word in it comes either from the source or from the template. A person at Fulkerson Advisors checks every fact before anyone at the client can see it.

We do not use client content to train AI models, and we send it only to AI providers whose terms bar them from training on it. What our operators learn in review may help us improve Keyholder’s templates and prompts, but those changes carry no client content.

Keyholder treats the text of mail as data, never as instructions. Nothing written in a message can change who sees what, choose a workspace or start an action.

Keyholder runs on Cloudflare. Each client has its own workspace, with its own database holding that client’s facts, its map of outside companies, its review history, the log of set-aside mail and the audit log. No other client’s data is in it. A shared database holds accounts, roles, connection status, job progress and spending, and no client content.

The headers and bodies Keyholder stages for screening and extraction are kept in Cloudflare’s object storage, encrypted with AES-256-GCM under a key that belongs to that client’s workspace alone. That key is itself encrypted under a master key we hold, and is bound to its workspace, so it cannot unlock another client’s data. Background jobs carry only identifiers, counts and error codes, never content, and their records are deleted after 7 days.

Operators are Fulkerson Advisors staff who run the engagement. They sign in with their Microsoft work account and a passkey, and see only the workspaces they are assigned to. They see draft facts and the quotes those facts rest on, so they can check them and decide which to release.

People the client invites have one of two roles, and the client decides who has which. Leadership sees every released fact. Team sees released facts except those marked Leadership-only, which are facts that may concern a person’s pay, performance, conduct, health or family. No one at the client sees a fact before an operator releases it, and no one at all sees a held fact until counsel decides.

When the client or its counsel tells us that a message is privileged or personal, we erase its staged copy and every fact drawn from it, including each fact’s history. What remains is an audit entry that records the erasure and its reason, with no content. The message’s headers can stay in the encrypted working files of the screening run that read them until those files are deleted, at the latest when the engagement ends.

When the engagement ends, we delete the staged mail and destroy the key that encrypts it. The record that remains holds the checked facts, each with its history and the short quote that supports it, and counts of who emailed which outside companies. We delete it within 30 days after the engagement ends, or sooner if the client asks, and then confirm in writing what was erased and how long backups last. Until then, the client may ask us for an export of it.

Cloudflare can restore our databases to any moment in the past 30 days. Anything we erase or delete therefore survives in those restorable copies for up to 30 days, and is gone for good only once they age out.

We may keep usage data about how Keyholder runs, such as counts, costs and error rates, in a de-identified and aggregated form that identifies neither the client nor any person. We use it to run and improve Keyholder.

We share client content only with the companies below, which process it for us, or when the law requires us to. We do not sell it.

• Cloudflare hosts Keyholder, its databases and the staged mail, and runs Clairic on Workers AI.
• OpenRouter routes Jev requests to TypeSafe.
• TypeSafe runs Jev and answers those requests.

Microsoft is not on this list, because Microsoft 365 is the client’s own system. Keyholder reads it through Microsoft Graph with the access the client’s administrator grants. We will update this list before Keyholder reads any new source of data or uses any new processor.

Every request is checked on our side against the signed-in person’s membership in the workspace it asks for. A workspace named in a link or in a message is never trusted on its own. Sessions last one hour. Our tests check that a person or a job from one workspace cannot reach another, and error records carry codes, never content.

No way of storing or sending data over the internet is completely secure, and we cannot promise that it will never be exposed.

If your mail is in a mailbox Keyholder reads, the client controls that mail and decides requests about it. You can ask the client directly, or write to us and we will pass your request to the client and help it respond, for example by erasing a message as section 08 describes.

If you sign in to Keyholder, you can ask us to see, correct or delete the account information we hold about you.

When this statement changes, the date at the top of this page changes with it. We will tell clients of any material change.

For questions about this statement or about data in Keyholder:

Email: privacy@fulkersonadvisors.com
Address: PO Box 410127, Cambridge, MA 02141