Your data is yours. Period.
pencild is built with privacy and security at its core. Your client data is encrypted, isolated, and always under your control.
Your data is encrypted
Every user has their own unique encryption key. Your encryption key is itself encrypted with a master key. Even we can't read your data.
-
Email content
- Subject lines, body text, and snippets are encrypted before storage.
-
Phone numbers
- All client phone numbers are encrypted with your personal key.
-
Addresses
- Physical addresses and location data stay private and encrypted.
-
Personal notes
- Client notes and project details are encrypted at rest.
-
Financial info
- Costs, deposits, and payment information are protected.
-
Instagram messages
- DM content is encrypted with your unique key.
Only you can see your data
Every database query is scoped to your account. Cross-user access is technically impossible. Our staff cannot read your personal client information.
- Account-scoped queries.
- Every request for data is automatically filtered to your account only.
- Staff cannot access.
- Our team cannot view your encrypted client data, even for support.
- Database-level isolation.
- Protection is built into the database architecture itself, not just the application.
Studio boundaries are real
If you're in a studio, they see studio-level data only. Your personal data stays private.
- Artists see data assigned to them
- Studio owners see studio data
- Nothing crosses boundaries
Delete means delete
Soft delete keeps data for 30 days in case you change your mind. After that, it's permanently gone. Cancel your account and your data is deleted after 30 days.
- 30-day safety net.
- Deleted data is hidden but recoverable for 30 days. Change your mind? Just ask.
- Permanent deletion.
- After 30 days, data is permanently removed. No hidden retention.
- Cancellation is clean.
- Cancel your subscription and everything is deleted after the 30-day grace period.
Export anytime
Your data belongs to you. Export clients, projects, and records whenever you want.
Connected accounts are protected
Instagram and email tokens are encrypted with your personal key. Tokens refresh automatically. Disconnect an account and tokens are immediately invalidated.
-
Encrypted token storage
- OAuth tokens for Instagram and email are encrypted with your personal encryption key before storage.
-
Automatic refresh
- Instagram tokens are refreshed automatically 10 days before expiration. You never need to reconnect manually.
-
Instant disconnect
- Disconnect an account and tokens are immediately invalidated and removed from storage.
-
Security logging
- Access to connected accounts is audited. Logs record user IDs, never emails, for security.
Your data. Your control. Always.
Start your free trial and experience a system built with your privacy in mind.
14-day free trial. Add a card to extend to 30 days.