Straight answers for whoever has to approve this.

What access do you ask for?

Read-only, and only for the bases you choose. Today you connect with a personal access token: you create it in Airtable and pick its bases, and it needs only schema.bases:read and data.records:read. “Sign in with Airtable”, which Airtable recommends over pasted tokens, isn't available yet; when it is, it asks for those two scopes plus user.email:read, to show which account is connected.

A token that can write (any :write or :manage scope) is refused when you paste it, so we never hold one that could create, change or delete anything in your Airtable. A token belongs to the person who made it: if they revoke it or leave your workspace, backups stop, and the next receipt (or a reconnect email) tells you.

How are Airtable tokens stored?

Encrypted with AES-256-GCM before they touch the database, using a key that lives in the hosting environment, not in the database. Disconnecting deletes the token immediately. You can also revoke access from Airtable's side at any time. If you connect a Slack webhook for alerts, its URL is encrypted the same way, and we only ever post to it.

Where does my data live?

• Backups (records, field values, table structure) are stored in a Postgres database run by Neon, on AWS in the US (us-east-1). Storage is encrypted at rest; all connections use TLS.
• The app runs on Vercel. Airtable is only contacted from our servers, never from a third party.
• Attachment files are copied after each backup into a private Vercel Blob store in the US (us-east-1), encrypted at rest, up to your plan's allowance. In the app each one is served only to you, signed in, as a download (the one exception is below). Files over 250 MB, and files past your plan's allowance, are kept as names only, and the base page says how many.
• Payments go through Stripe. We never see card numbers. Email goes through Resend.

Who can see my backups?

You, when signed in. On our side, one person (the founder) has database access, used only to keep the service running or when you ask for help with a specific problem. Your data is never sold, shared, used for advertising, or used to train AI models.

Which links work without signing in?

Three kinds, all made by you, all unguessable:

• Live CSV links (Vault) serve one table of your latest backup, so Google Sheets or Excel can import it. You create each one on the base's page and can revoke it there; it stops working at once.
• File links in a deleted-rows CSV. When you download the rows a backup found deleted, each kept attachment gets a link Airtable can fetch while you restore. Each link opens one file, can only read it, and expires after 7 days. They can't be revoked early, so treat that CSV like the files themselves.
• Email links to stop receipts or decline an invitation. They change one setting and show no data.

How is my account protected?

• Two-step sign-in with any authenticator app, on every plan including Free, plus ten single-use backup codes. After 10 wrong codes in a row, sign-in for that account pauses.
• Signed-in devices are listed in Settings, and you can sign any of them out. Changing your password signs out every other device.
• Your password again before downloading your whole history or deleting all backup data, so a session left open on a shared computer can't hand over or wipe everything.
• Passwords are hashed, never stored. Sign-in, sign-up and password resets are rate limited.

Do you have SOC 2 or ISO 27001?

No, not yet. We're a small, new company and we won't pretend otherwise. If your organisation requires a certified vendor, we're not the right choice yet, and we'd rather tell you now. What we can offer: this page, a data processing agreement on request, and answers to your security questionnaire by email.

How do I delete everything?

Settings → Connections → Delete all backup data removes every connection, base, backup and stored file immediately, and keeps your account. Deleting your account removes everything, including your login. Our database provider keeps point-in-time recovery data for a short window (up to 7 days) before it's gone for good.

What can't be backed up?

Airtable's API doesn't expose automations, interfaces, view filters or record-level revision history to anyone, so no third-party backup tool can save them, including this one. Record comments are in the API, but we don't ask for that permission or copy them yet. We back up every table, field, record and attachment file your token can read, within your plan's file allowance. See how the options compare.

If something goes wrong

If we ever find that your data was accessed by someone who shouldn't have, we'll email you within 72 hours with what happened and what we're doing about it. Found a vulnerability? Email hello@nightclerk.app; we reply within two working days and don't take legal action against good-faith research.

If Nightclerk shuts down

You get at least 90 days' notice by email, and every backup stays downloadable until the last day. Settings → Account → Download your data gives you the whole history in one ZIP: every version of every record, in plain JSON you can read without us.