Security questions come first for MSPs, so this page answers them plainly. It is updated in the same release as any change it describes.
For a one-page summary for security reviewers, with questionnaire answers and the Data Processing Addendum, see the Trust center.
What SeatReaper stores today
- Your workspace: your MSP's name, plan and billing status.
- Your team: each member's email address and role.
- Your clients: each client's name, whether it is active, and the tool IDs you record for it (Microsoft 365 tenant ID, N-central customer ID, Cove customer).
- Support requests: the requests your team sends from Get help and the replies.
- Invites: the invited email, role and expiry. The invite link itself is never stored; only a one-way hash of it is.
- The audit log: a record of every change described below.
- Website visits: on the public site and sign-in pages, the page, campaign tags and referring site, with a visitor code that changes every day. No cookie, no IP address stored, and nothing is counted when your browser sends Global Privacy Control or Do Not Track. See the Privacy Policy.
SeatReaper does not store passwords (sign-in is handled by Supabase Auth, which keeps only salted hashes) or card details (Stripe handles payments; SeatReaper stores only the Stripe customer and subscription IDs).
Who can see your data
Every workspace's data is isolated in the database itself, not only in the app. Each table row carries your workspace ID, and database row-level security rules allow a signed-in person to read and change only their own workspace's rows, within what their role permits. A bug in a web page cannot show one MSP another MSP's data, because the database refuses the query.
Inside your workspace, roles decide who can do what, and owners can limit a tech or viewer to selected clients; the same row-level security rules enforce that limit. See Inviting your team and setting roles.
The audit log
Every change to your workspace, team, invites and clients, including anything SeatReaper support does, is recorded automatically by the database: who made it, what changed (old and new values), and when. Billing changes are recorded with the Stripe event that caused them. People can sign in with Microsoft, and owners can require it for the whole team. Owners can read the log on the Audit log page, stream it to a SIEM, and get an email when something sensitive happens. See Security alerts and audit log streaming.
Entries cannot be edited or deleted by anyone through the app, and the database itself rejects edits and deletions. The only exception is closing the workspace: 30 days after an owner closes it, the audit log is deleted with everything else.
Two-step verification
Every login can add an authenticator app, and owners can require it for the whole team. It is enforced by the database, not just the app, so a stolen password alone can't read or change your data. See Two-step verification.
SeatReaper support
SeatReaper staff can open a time-limited, read-only view of a workspace to answer a support request, only while an owner has granted access, and make account changes such as a plan change or ownership transfer. Each one needs a written reason and is recorded in your audit log. See What SeatReaper support can see and do.
Connections to your tools
Connectors are read-only by design: SeatReaper reads users, licenses, devices, backup status and billing and never changes anything in the connected tools on its own. The one exception is opt-in: on Growth and up an owner can turn on removals, which uses a separate Microsoft app each client's admin approves, and every change is confirmed by a person and logged. Each setup guide lists the exact permissions SeatReaper requests and how to revoke them: Microsoft 365, N-central, Cove, Pax8, Partner Center, Datto RMM, Datto SaaS Protection, KnowBe4, Google Workspace, NinjaOne, CrowdStrike Falcon, SentinelOne, Webroot, Huntress, Sophos Central, Duo, Acronis and Flowroute. The billing check reads billing from the ConnectWise PSA or Autotask connection under Settings > Ticketing. From Flowroute call and text records SeatReaper keeps only the date of each number's last call and last text, never who was called or what a text said.
Microsoft 365 uses Microsoft's own admin approval, so SeatReaper never holds a password for your clients' tenants. Google Workspace uses a service account you create and each client's super admin allows, so SeatReaper holds no Google password either. N-central tokens, Cove passwords, Pax8 and Partner Center client secrets, Datto RMM and Datto API keys, KnowBe4 keys, Google service account keys, NinjaOne and CrowdStrike API secrets, SentinelOne API tokens, Huntress, Sophos and Acronis API secrets, Duo secret keys and Webroot sign-ins are encrypted with AES-256 before they are stored (each bound to its workspace, and KnowBe4 keys also to their client), in a table no app role can read, with the key kept outside the database. They are never shown again after you save them.
HIPAA, BAAs and certifications
SeatReaper does not sign Business Associate Agreements (BAAs) and is not designed to receive protected health information (PHI): it reads accounts, licenses, devices, backups and training sign-ins, not email, files or patient records. SeatReaper itself has not been audited or certified against any framework.
The compliance evidence reports give you evidence for your clients' HIPAA, CIS Controls, NIST SP 800-171 and cyber insurance reviews. They do not make you or your clients compliant.
Payments
Payments run entirely on Stripe Checkout and the Stripe customer portal. Card numbers go straight to Stripe and never pass through SeatReaper. Stripe's messages to SeatReaper are verified by signature before anything changes.
In transit and at rest
All traffic uses HTTPS. The database is encrypted at rest by its hosting provider, Supabase.