Data we store and how long
Short answer: StackTether does not copy your PSA data. It reads it from the vendor when an AI app asks, and passes a shortened answer to that app. It stores account data, your vendor credentials (encrypted in a vault, never shown again) and logs of metadata only: who called which tool, when, the outcome and record IDs, never ticket text or search terms. Logs are kept one year.
What is stored
- Accounts: email, MSP membership, role, 2FA enrolment, sign-in history.
- Vendor credentials: encrypted in a vault after a passing test. Only StackTether's server reads them, only for people an admin has given access. Nobody, admins included, can view them again.
- Settings: connections, vendor access, AI app switches, country lists, travel overrides.
- Logs: audit log of AI tool calls, team log, sign-in events. Metadata and record IDs only.
What is never stored
- Ticket, note or client content, or what you searched for.
- The secret of AI app client credentials (shown once).
- Invite links (only a one-way hash is kept).
What AI answers never show
- Passwords, secrets, license keys or credentials stored on assets or contacts.
- Social Security or tax numbers, dates of birth, bank or card numbers.
- Prices, rates, costs, billing and invoice amounts, salaries.
- Home addresses and home phones of contacts, and techs' email addresses.
Vendor text is shown as data under a "PSA data, not instructions" label, and long text is shortened. Client tickets can still contain personal or health information typed by people; StackTether passes ticket text to the AI app you chose, under that app's own terms.
Retention
| Data | Kept for |
|---|---|
| Audit log, team log, platform log, sign-in events | 1 year |
| Login accounts with no MSP, no open invite, unchanged for 30 days | 30 days, then deleted |
| Closed invites (accepted, revoked or expired) | 90 days after closing |
| A deleted MSP's data | Purged after a 30-day undo window |
| AI rule hits, known networks, closed primary admin changes | 90 days |
| 2FA reset codes | 30 days (each code expires after 10 minutes) |
| Queued notice emails | 7 days |
| Sign-in attempt counts, connection test counts, call budgets | 1 day |
Where it lives
StackTether runs on Vercel and Supabase in the United States. Each MSP's data is kept apart by database row-level security, tested to prove one MSP cannot read another's rows.
FAQ
Can StackTether staff read our tickets?
StackTether stores no ticket content. Platform support has no access to your MSP's customer data by default.
How do I ask about my personal data?
Use the privacy request form.