Privacy Policy

1. Who we are

MSPDock ("MSPDock", "we", "us") is operated by Tech Extranet LLC, an Ohio limited liability company. This policy explains what information we collect when you use MSPDock at mspdock.com and its subdomains ("the Service"), how we use it, who we share it with, how long we keep it, and the choices you have.

MSPDock is used by businesses ("customers"), mostly managed service providers, to run their work with their own clients and employees. For the data a customer puts into MSPDock about its clients, employees and job applicants, the customer decides what is collected and why, and we process it on the customer's behalf and under its instructions. If you are one of a customer's clients, employees or applicants, please contact that business with questions about your information; we will help them respond.

2. Information we collect

• Account information: names, email addresses, company details, roles and sign-in information for the people who use MSPDock. Sign-in is handled by our authentication provider; we do not store passwords.
• Business data you enter or import: clients, contacts, reports, quotes, invoices, contracts, agreements, tickets, time entries, assets and similar records.
• Data from accounts you connect: see section 4.
• HR data (if the customer turns on HR): employee records, time off, timesheets, schedules, performance reviews, job applications and resumes, offer letters, onboarding forms and signatures. If the customer turns on the related features, this can also include pay and compensation records and sensitive details such as Social Security numbers, bank account details for direct deposit, and tax and employment-eligibility forms (W-4, I-9). See section 6.
• Payment information: subscription billing and online invoice payments are processed by Stripe. We do not receive or store full card or bank account numbers for these payments.
• E-signature records: when someone signs a quote, agreement, offer or form, we record their typed or drawn signature, the time, IP address, browser details and a fingerprint of the document.
• Technical and usage data: IP addresses, browser and device details, pages and features used, and error reports, used to run, secure and improve the Service.

3. How we use information

• To provide the Service: store your records, generate documents and reports, send the emails and notifications you trigger, and sync with the accounts you connect.
• To provide AI features you use (see section 5).
• To process subscription and invoice payments.
• To secure the Service, prevent abuse, and investigate problems.
• To provide support and tell you about changes to the Service.
• To meet legal obligations.

We do not sell personal information, share it for advertising, or use your business data to build advertising profiles. Your data belongs to you.

4. Connected accounts (QuickBooks, PSAs, Microsoft 365 and others)

An owner or admin of a customer account can connect other services. MSPDock only accesses a connected account after someone with access to it signs in and approves the connection, and only for the features described below.

• QuickBooks Online (Intuit): we read the company's customers, products and services, tax settings, invoices, payments and employees, and we create or update invoices, record payments taken through MSPDock, and (if timesheets are used) add employee time activities. We use this data only to match your MSPDock clients to QuickBooks customers, send invoices and hours to QuickBooks, and keep payment status in step. We keep a copy of the customer list and the links between MSPDock and QuickBooks records so the integration works. QuickBooks data is not sent to our AI provider and is not shared with anyone other than the service providers in section 7.
• PSA and documentation tools (e.g. Syncro, Autotask, ConnectWise, HaloPSA, IT Glue): we import clients, contacts, tickets, assets, time entries and related records, to build reports, billing and quotes.
• Pax8 and distributors: we read subscriptions, product and pricing information, and billing records to keep contracts and quotes accurate.
• Microsoft 365: if a user connects a mailbox, we read and send email from it for the features they use. If an admin turns on calendar sync, we write the company HR calendar (approved time off, birthdays, work anniversaries, holidays) to a calendar they choose and, if enabled, approved time off to employees' own calendars.
• Stripe: to accept online payments of invoices and manage subscriptions.

Access tokens for connected accounts are encrypted. You can disconnect an account at any time in MSPDock's settings (and, for QuickBooks, from the Apps section of QuickBooks). When you disconnect, we delete the access tokens and ask the provider to revoke them. Records already copied into MSPDock (for example the QuickBooks customer list or imported tickets) stay with your account until you ask us to delete them or close your account.

5. AI features

Some features use Anthropic's Claude models: drafting report summaries, polishing text, summarizing product descriptions, checking whether time is within a contract's scope, and triaging email. When you use these features, the content needed for that task (for example report findings, ticket and time entry text, product details, or the email being triaged) is sent to Anthropic to produce the result. Under our agreement with Anthropic, this content is not used to train their models. We do not send QuickBooks data, compensation records or sensitive HR data (section 6) to our AI provider. AI output can be wrong and should be reviewed before it is shared.

6. HR and sensitive data

• HR records are visible only to the employee, their managers and the customer's admins, following the customer's settings. Compensation is encrypted individually, visible only to the employee, their managers, admins and people an admin specifically allows, and every view is logged.
• Sensitive details collected in onboarding (Social Security numbers, bank details, completed tax and eligibility forms) are encrypted with a separate key per record and can be viewed only by the customer's designated payroll handlers after recent re-authentication. Every view and download is logged.
• These sensitive details are destroyed after the customer's retention window (30 days at most), except forms the law requires employers to keep, such as Form I-9 and Form W-4, which are kept for their legal retention period and then destroyed. Destroying a record deletes both the data and its encryption key, so copies in backups can no longer be read.
• MSPDock staff do not access compensation or sensitive vault data, and impersonation tools used for support do not reach HR data.

7. Who we share information with

We share information only with service providers that help us run the Service, under contracts that limit their use of it, and as the law requires:

• Hosting and infrastructure: Vercel (application hosting), Railway (database and document generation), Cloudflare (DNS and email routing)
• Authentication: Clerk
• Email delivery: Resend
• Background processing: Inngest
• Payments: Stripe
• AI: Anthropic (section 5)
• Error monitoring: Sentry (credentials and secrets are removed from error reports before they are sent)
• Services you connect: the providers in section 4, to the extent needed for the features you turn on
• Legal and safety: when required by law, legal process, or to protect the rights, property or safety of our users or others
• Business transfers: if MSPDock is involved in a merger, acquisition or sale of assets, subject to this policy

8. Security

We use encryption in transit (TLS) for all traffic, separate each customer's data from every other customer's, restrict access by role, and add our own encryption for access tokens, compensation records and sensitive HR data, with access logs for the most sensitive information. No system is perfectly secure; if we learn of a breach affecting your information, we will notify you as required by law.

9. Cookies

We use essential cookies to keep you signed in and secure your session, and a preference cookie for light or dark mode. We do not use advertising or cross-site tracking cookies.

10. How long we keep information

• Account and business data is kept while the account is active.
• When an account is closed, or a customer asks us to delete data, we delete or anonymize it within 30 days, except where we must keep it by law.
• Sensitive HR data is destroyed on the schedule in section 6.
• E-signature records and access logs are kept as long as the signed document or the related record, or as the law requires.

11. Your rights and choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you, and get a copy in a portable format
• Correct inaccurate information
• Delete your information
• Object to or restrict some processing, and withdraw consent where we rely on it
• Not be discriminated against for exercising these rights

Email privacy@mspdock.com to make a request. If your information is in MSPDock because a business uses it (for example you are its client, employee or applicant), we will pass your request to that business, which is responsible for answering it.

12. Where data is processed

We and our service providers are based in the United States, and information may be processed in the United States and other countries where they operate. Where the law requires, we use appropriate safeguards for these transfers.

13. Children

The Service is for businesses and is not directed to children under 16. We do not knowingly collect information from children.

14. Changes to this policy

We will post any changes here and update the date at the top. If a change is significant, we will tell account owners by email or in the Service before it takes effect.

15. Contact

Tech Extranet LLC (MSPDock) · privacy@mspdock.com. See also our Terms of Service.