Local by design
Business data lives in files stored at a location your company controls — a shared drive, a managed folder or the user's workstation. There is no automatic upload of your task records to our servers.
Security & data
A local-first tool with a small, well-defined online surface.
We are deliberate about what Kelavon Task Manager sends and stores. Nothing on this page is a certification claim — it describes how the product is designed to operate today.
One-time activation, device-bound
The application contacts our licensing service once, at activation. The request carries the license key, a random installation ID, and normalized board/disk/CPU identifiers over TLS — used in memory for matching, stored only as per-anchor salted hashes, never raw. After activation the app works fully offline; verification is local (2-of-3 component match for hardware-bound licenses, with an installation-ID fallback when hardware identifiers aren't readable). There is no periodic phone-home and no remote-revocation channel.
No account, no password
There is no login system. Your license is looked up by the email you purchased with, via a short-lived emailed link — see /license-help (view-only).
Payments handled by Stripe
Payments are processed by Stripe as merchant of record. Card details never touch our systems — we receive purchase status, order references and billing metadata only.
Download integrity
Download links are short-lived and cryptographically signed, never a permanent public file path. The installer itself is not currently code-signed with an Authenticode certificate, so Windows SmartScreen will report an unverified publisher on first run — verify the published SHA-256 checksum on the download page before installing.
Documented handling
Full details of how personal data is collected and used are in our Privacy Policy and License Activation Policy. Contact privacy@kelavon.com with questions.
What we do not claim
- Device binding is intended to resist casual license sharing. It is not tamper-proof machine enforcement and cannot guarantee prevention of executable patching, local-state manipulation, complete virtual-machine cloning, disk-image duplication, or attacks performed by a person controlling the device.
- We do not describe the software as "unhackable", "fully compliant" or "certified".
- We do not assert regulatory compliance on your behalf — that is your organisation's assessment.
- Claims on this page describe current behaviour and may evolve as the product matures.
Reporting a vulnerability
Email security@kelavon.com. A machine-readable /.well-known/security.txt is also published for automated tooling.