How your configuration is handled

Passwords, PSKs and keys are stripped before storage — irreversibly, for us too.

A leaked copy of the database is not readable on its own.

Then the configuration is deleted. Your report and findings stay.

Do I have to give you access to my router?

No. You paste the text of a configuration export (/export) or upload it as a file. MKRouterKit never connects to your device, your network or your public IP address. There is nothing to install and no account to create for a free audit.

Are my passwords stored?

No. Before anything is written to the database, passwords, pre-shared keys, SNMP communities, WiFi keys and private keys are replaced with <redacted>. That removal is irreversible — there is no copy kept anywhere and no way for us to recover them. Password strength is evaluated during the upload itself, while the text is still only in memory, which is why the report can still tell you that a WiFi password is weak without us keeping it.

So what exactly is stored, and for how long?

The remainder of the configuration — interfaces, addresses, firewall rules and so on — is stored encrypted and is deleted automatically after 7 days. Alongside it we keep the audit result itself: your score, the findings, the device hostname and the RouterOS version. Those contain no secrets and stay available, so you can return to your report later.

What does the encryption actually protect against?

The realistic accident: a leaked database copy or a forgotten backup. Holding a copy of the database is not enough to read the configurations in it. What encryption cannot do is undo a secret once it is stored — and that is exactly why passwords and keys are removed instead of encrypted. What was never stored cannot come back. We use standard authenticated encryption and are happy to name the exact scheme if you write and ask; we just do not publish the details of our own setup on a public page.

Can you, the operator, read my configuration?

Not the secrets — those are gone before storage, for us as well, and no copy is kept. The remaining text has to be readable by the application itself, because that is what the network wizard, the documentation and the AI analysis are built from. The admin interface deliberately offers no way to display a configuration, and support work is done from the report, not from your configuration. After 7 days there is nothing left to read at all.

Is anything sent to a third party?

The configuration is never sent anywhere as part of a normal audit — all 58 checks run on our own server. The only exception is the optional AI analysis, which you have to choose and pay for explicitly: in that case the relevant configuration sections, with secrets already removed, are sent to the Anthropic API (api.anthropic.com) to produce the written analysis. If you never request it, nothing leaves the server.

What about payment and invoicing data?

Card details never reach our server — payment runs entirely on Stripe. We keep your billing details and the invoice because Czech tax law requires tax documents to be kept for ten years; that obligation overrides a deletion request for those specific documents. An EU VAT ID you enter is verified against the European Commission's VIES service. Token codes are e-mailed to the address you give at checkout.

Do you track me? Why is there no cookie banner?

Because there is nothing to consent to. This site sets no cookies for measurement, uses no third-party analytics, and writes nothing into your browser. Visits are counted on our own server as daily totals: which page, which kind of source, the referring site's domain, desktop or mobile. Your IP address and full browser identification are never stored — they go into a one-way hash that also contains today's date, which lets us count how many people visited today without being able to recognise anyone tomorrow. Report links never reach the statistics: query strings are discarded and every report is counted under a single /audit/:id entry, so what you audited cannot be read out of it.

What happens after 7 days?

Your report, score and findings stay where they are — you can reopen them any time by entering a token code you have already used on the audit page. What disappears is the configuration text, so the network wizard, the documentation module and the AI analysis need a fresh upload after that. If you paid for a module, re-running it on the same device within 30 days is free.

Should I export with show-sensitive?

You do not need to. A plain /export is enough for every check except the password-strength ones, and secrets are stripped on arrival either way. If you do want your WiFi and VPN passwords judged, use /export show-sensitive — the values are used during the upload and then thrown away, never stored.

Can you delete my data right now?

Yes. Write to support@mkrouterkit.com from the address you used and we will delete your audits and any unused tokens. Issued tax documents are the one exception, for the legal reason above. You do not have to ask about the configuration itself — it goes away on its own.