Privacy Notice

Who we are

CloudArq is the controller of the personal data described in this notice.

Contact us at [email protected], or by post at P.O. Box 37, Shefa-'Amr 2020015, Israel.

What we collect, and why

The data needed to provide your account and run the service. Nothing is collected for advertising.

Each kind of data, what we use it for, and its legal basis:

Your account

Your email address, your password as a hash, your two-factor secret and your backup codes. We use them to provide your account. Legal basis: our contract with you.

What you upload

The analysis of each scan you upload: your cloud account's ID and name, its roles, and who can get into each, which can name people, such as a user in one of your policies; when AWS refused the collector a call, AWS's message about it, with (removed) in place of the session, user or device name it gives for whoever ran the collector (a role's own name stays as AWS wrote it); and when a call went unanswered, the collector's reason; and the owners you declare as yours.

Whether the account belongs to an AWS Organization. If it does: the Organization's ID, its management account's ID and its feature set. If AWS refused that read, we keep that it was refused.

What the engine works out from your file: which owners count as yours, which it asks you about, each role's path, which roles AWS made for its own services, and what each of your answers would change. Your scan file itself stays on your computer.

We use them to show you the results. When an upload names other people, we handle their details only for you, on your instructions. Legal basis: our contract with you.

Security events

Sign-ins, sign-outs, lock-outs and changes to your account, with the time. We use them to keep accounts secure. Legal basis: our legitimate interest, and yours.

Server logs and error reports

The requests our server received and how it answered, and, when something fails on our server, the error's type and where in our code it happened, never anything you typed. For an upload we refused or that stalled: your workspace's ID and how many bytes arrived. We use them to run the service and fix faults. Legal basis: our legitimate interest.

Page views

Counted by Plausible, without cookies and without anything that identifies you. We use them to learn which pages are read. Legal basis: our legitimate interest.

Your email to us

What you write to [email protected]. We use it to answer you. Legal basis: our legitimate interest, or our contract with you when you write about your account.

Billing

Paddle sells the paid plans and holds your payment details; we keep a record of each order. We keep these records to comply with tax law. Legal basis: a legal obligation.

We never ask for credentials to your cloud: no access key, no token and no role for us to assume. We do not sell personal data or share it for advertising.

The Explorer

What you paste into the Explorer is analysed in your browser and never sent to us.

The Explorer's engine runs inside your browser tab, compiled to WebAssembly. What you paste is kept in the part of the page address after the #, which browsers never send to a server.

A link copied from the Explorer therefore contains your policy. Check what a link contains before you share it.

Where it is stored, and who processes it

Your data is stored by Hetzner in Helsinki, Finland. The providers below process parts of it on our behalf.

CloudArq is based in Israel, which the European Commission and the United Kingdom recognise as providing adequate protection for personal data. Transfers to providers based in the United States rely on each provider's data processing terms and, where the provider is certified, on the EU-US Data Privacy Framework. Google Cloud EMEA Limited may pass data to Google LLC in the United States, which is certified under that framework.

How long we keep it

Only as long as we need it. What We Store lists every item with its reason.

• Your account: While the account exists, and deleted within 30 days of closure.
• Your second factor: While the account exists, and deleted within 30 days of closure.
• An unconfirmed sign-up: Valid for 24 hours; deleted at the next sign-up after it expires.
• A password reset link: Valid once, for 30 minutes; deleted at the account's next password reset after that.
• Attempt counts: Kept for its window, from 15 minutes to a day, or 30 days for wrong codes. Ended counts are deleted as new attempts come in.
• A session: Ends after 1 hour without use, or after 24 hours at most.
• A sign-in in progress: Valid for 10 minutes; deleted when it is used, or at the account's next sign-in after that.
• Security events: 12 months; afterwards only a tamper-evidence fingerprint that identifies no one.
• Your uploads: Free: the latest read of each account. Deleted when you remove the account, and with your workspace.
  Beta, Starter: every change from the last 90 days; Organisation: from the last 13 months; up to 90 reads of each account. Deleted when you remove the account, and with your workspace.
• Your findings: Open: while we keep the latest read that shows it, or one made before it.
  Fixed: while we keep the read that fixed it, or one made before it, as we keep your uploads: on Free, the latest read of each account; Beta, Starter: those from the last 90 days; Organisation: from the last 13 months; up to 90 reads of each account, and always its latest.
  Deleted when you remove the account, and with your workspace.
• Your owners: Until you change or remove them. Deleted with your workspace.
• Server logs: 30 days.
• Error reports: 30 days.
• Backups: 30 days, rolling.
• Your email to us: 12 months after the conversation ends.
• Billing records: As long as Israeli tax law requires.
• Page views: Kept only as counts, which identify no one.
• Your theme: Until you choose Light again or clear this site's data.
• Your sidebar: Until you reset the sidebar or clear this site's data.

Cookies and browser storage

We set two cookies, both needed to sign you in, and Cloudflare sets one that tells people from bots. All three are strictly necessary, so there is no consent banner.

• __Host-session, set by our sign-in service, keeps you signed in, and lasts until the session ends: 1 hour without use, 24 hours at most.
• __Host-challenge, set by our sign-in service, carries a sign-in from your password to your code, and lasts 10 minutes.
• __cf_bm, set by Cloudflare, tells people from bots, and lasts until 30 minutes pass without activity.
• When you choose the Dark theme, your choice is kept in your own browser as cloudarq.theme, and never sent to us.

Plausible sets no cookies and stores nothing on your device. If you prefer not to be counted, block plausible.io in your browser or with a content blocker; every page works the same without it.

Your rights

You can access, correct, export or delete the data we hold about you. Email [email protected].

Under the GDPR and the UK GDPR, you have the right to access your data, to have it corrected or deleted, to restrict its use, to receive it in a machine-readable format, and to object to processing based on our legitimate interest. Israel's Protection of Privacy Law gives you the right to inspect the information we hold about you and to ask us to correct or delete it.

To delete your account, email [email protected]. We close the account and delete its data within 30 days. Encrypted backups expire 30 days after that, and billing records are kept for as long as tax law requires. Requests are free, and we respond within one month. We may ask you to write from the address registered to the account, so that no one else can request your data.

Complaints

Please contact us first. You also have the right to complain to a data protection authority.

In the European Union, contact the data protection authority where you live or work. In the United Kingdom, contact the Information Commissioner's Office. In Israel, contact the Privacy Protection Authority.

How we protect it

Passwords are hashed, every sign-in requires a second factor, and we hold no access to your cloud.

• Passwords are stored as bcrypt hashes; no one, including CloudArq, can read them back.
• Every sign-in requires your password and either a code from your authenticator app or one of your backup codes.
• Sessions are held on our server, and the session cookie cannot be read by any script on a page.
• Every page and every request travels over HTTPS.
• Backups are encrypted before they leave the server.

Changes to this notice

The date at the top of this notice shows the current version.

If a change expands what we collect or who receives it, we will email every account holder before it takes effect.