Where it runs
The application and its database run in Amsterdam, inside the EEA, on Railway. That means no restricted international transfer for you to explain to your own clients when they audit you. It ran in a United States region until 16 August 2026; the privacy notice and the data processing agreement both say so, because a privacy notice that quietly rewrites its own history is not one you can rely on.
Three sub-processors touch the service and each is named in the privacy notice with what it sees: Railway hosts, Resend carries email, and Anthropic reads CV text only when you use the optional enrichment feature, which is off until you turn it on and marks everything it produces.
Who can read it
Your book is one tenant in a multi-tenant system, and tenancy is the first rule of the codebase: every table carries the tenant, every query is scoped to it, and a cross-tenant read is treated as the most serious class of defect we recognise. Staff sign in with passwords stored as bcrypt hashes; session tokens are stored only as their SHA-256 digests, so a copy of the database does not contain a way in. Tokens we hold for third-party systems are encrypted with AES-GCM.
When our operator opens a support session into your book, that session is recorded on your own audit chain with its reason. You can read exactly when we looked and why.
What stops it being rewritten
Every compliance-relevant action writes a row to an audit chain, each row hash-linked to the one before. Since August 2026 the database itself refuses UPDATE and DELETE on those rows, so the append-only property holds against anyone holding the database password, not only against well-behaved application code. Anyone with the rows can recompute the chain and find the first break; the product ships an endpoint that does it on demand. Where the rules live maps every statutory artefact to its rule and its evidence.
How you get it back
The whole book exports from your own Settings as one bundle, whenever you choose: every register as importer-shaped CSVs, every stored document with its hash, and the audit chain. It is the same bundle our offboarding produces, and the offboarding version is round-trip verified, meaning we import it back into an empty book and check the result before handing it over. Leaving is a decision rather than a project, and keeping your own copy costs nothing.
Deletion is as deliberate as keeping. Documents carry retention categories with their statutory periods, a nightly job retires what has lapsed and leaves a dated tombstone, and a document a live record still needs is held with the reason stated. Erasure requests get the statutory answer: done where the law allows, refused with the exact basis and lapse date where it does not.
What we do not have yet
No ISO 27001, no SOC 2. Certifications of that kind cost more than a product at this stage can carry, and pretending otherwise would tell you something about how we would handle the rest. The DPA states the security measures that do exist and commits to 48-hour breach notice. When the certifications come, this page will say so; until then you are trusting the record above, which you can verify, over a badge, which you cannot.
Who is behind it
BookKept is built and operated by COM Computing Ltd, an Isle of Man company owned by Corey Musa. Before this he built and ran the member and ledger platform for a credit union: over a thousand members, every penny of interest accounted for and shown to the person it belongs to. The instinct is the same here, one record that reconciles, held where its owner can always reach it.
Support is him, by email, and replies come from a person: corey@comcomputing.im. There is no ticket queue to disappear into. If the answer to your question should have been on this page, the page gets updated.
The demo runs the same code as everything above
Open a real book with a fictional agency in it, export its evidence pack, and read its audit chain yourself.