GPlatform Control privacy notice

Which half this is about

GControl runs on your infrastructure, and its privacy notice sets out exactly what leaves your instance, field by field, taken from the wire protocol. This notice is about what happens to it once it arrives, and about the account you hold with us.

For this, the controller is Gelhaus Solutions, Eichenwald 3, 49624 Löningen, Germany, contact@gplatform.org.

Where we host an application for you, we are the processor for what is inside it, and the data processing agreement with the annex for this service applies to that.

Your account with us

The organisation (its name and a contact email), the people you add to it and the roles you assign them. For each person: the email address and display name, a password hash, an authenticator secret stored encrypted and the time it was confirmed, recovery codes, the number of failed sign-ins and the time a lock ends, when they last signed in, and which version of our terms they accepted and when (see "What you accepted" below). Recovery codes exist; keep them somewhere that is not the account they recover.

Sessions. Each sign-in to the portal or the console keeps a digest of the session token (never the token itself), the IP address and the browser it came from, when it began and when it expires. A session is deleted 90 days after it expired or was ended.

Notes staff keep. Our staff keep free-text notes about an organisation and its licences, and give a reason when they act on one, for instance when they suspend a licence, issue a command or release a key. Those notes and reasons are part of what an access request about you returns. They are kept with the record they belong to.

Support conversations, and who took part in them.

What we hold about your instances

The instance identifier, the label you chose for it, its version and the protocol features its build understands, the catalogue and allowlist versions it holds, the public half of the key it signs app leases with, and its current emergency state.

Per application: its id, version, manifest reference, installed module ids and versions, condition, health report, at-rest mode, and whether it holds a licence seat.

Counts, never identities. A number of end users an application can see, with an opaque fingerprint of the datastore it counted them in so replicas can be de-duplicated. No end-user data reaches us, from any application, ever.

Usage aggregates the broker already folded, as the billing and usage record.

Chain heads: the head hash of your audit chain and of your stamp ledger. Head hashes, not entries: anchoring proves a chain has not been rewritten without telling us what is in it.

Command results, which are small, structured, and never contain application user data.

Health values, filtered against what the application declared in its manifest before they ever leave your side, kept for 90 days.

Applications we host for you

Where we host an application for you, we run it as a tenant of a cloud deployment. We keep which organisation it belongs to, the application and its version, the deployment that serves it (a shared one, or one of its own), the tenant's status, and where its data went if it was moved to another instance. The data inside the application is yours; we are its processor under the data processing agreement and the annex of that application.

Our staff can ask for your approval of a privileged action on a deployment. The request carries what staff said they need to reach, the reason, who asked and for how long. You approve or refuse it in the portal, and what was asked, who answered and what was granted are kept. The instructions we send to an application, such as a change of state, are kept with who decided and why, and with what the application answered. Changes to your subscription reach us from GPlatform Billing, our own service under the same controller, and are kept with the record.

Why. Providing what you bought (Art. 6(1)(b) GDPR), and being able to show who had access to your deployment and why (Art. 6(1)(f) GDPR).

The one place your people can appear

audit.tail is a read verb and read verbs are on by default. It returns recent rows of your audit log: the sequence number, the time, the action, the display name of whoever did it, the subject, and the row hash.

It deliberately does not return the IP address or the user id, both of which your local entry does store. So what can reach us is an administrator's display name and what they did, not where they were, and never your application end users.

If you would rather that did not leave, switch audit.tail off. It is your allowlist and we will not turn it back on.

Diagnostics, which are off

Opt-in and off by default, recorded per instance with who turned them on, and revocable. The absence of a consent record means off, so a failed write can never quietly enable sharing.

When on they carry an error rate, a slow-request rate, and fingerprints of stack traces: hashes, not traces. No paths, no arguments, no data.

The key we hold

The private half of each instance's lockdown key, in Vault, one per instance. The database holds the public half and a path, never the material. It moves only during an unseal, after a person has verified the requester out of band.

Why we may do this

Providing the licensed software and the services attached to it is performance of a contract, Art. 6(1)(b) GDPR.

Licence enforcement, counting seats and usage, the integrity of the audit anchors and the security of the service are legitimate interests under Art. 6(1)(f): the interest is in the software being used as licensed, and in an incident being reconstructible afterwards.

Diagnostics are consent, Art. 6(1)(a), given per instance and withdrawable.

How long

Instance, licence and entitlement records for as long as the licence and afterwards as the record of it. Health samples 90 days. Mail we send you, such as a password reset, 90 days after it was sent; a reset link is removed from the stored message as soon as it has gone out. The console's audit log, which records who did what and from which IP address, and the record of each download with its IP address: 12 months. Meter aggregates as the billing and usage record. Audit anchors for the integrity of the chains they anchor. Diagnostics stop arriving the moment consent is withdrawn. Sessions 90 days after they expire or end. Cloud access requests and instructions to hosted applications as part of the tenant's record.

Who else touches it

Hosting on servers rented from IONOS SE (Germany) and on our own hardware in Germany. All in the EU, no transfer to a third country. No analytics service and no advertising network.

What you accepted, and the notices we send

When you accept our terms, GPlatform Legal, another service of ours under the same controller, records it: the address of your account, the identifier the product knows you by, which versions you accepted, when, through which product, and your IP address and browser at that moment. It also keeps the mails with which we announce a change before it binds (to your address, with whether they arrived and any bounce) and anything you object to; they come from legal@gplatform.org. The entries are chained by hashes so that nobody can change them afterwards. Proof of acceptance is a record in its own right and is kept longer than your account data, because we have to be able to show what you agreed to: at the end of the third calendar year after the year your account closed (the sixth if you ever paid for something), your address is removed, the identifier becomes a keyed hash, your IP address and browser details are erased from each entry, and what stays is the version, time, source and hash. The GPlatform Legal privacy notice describes that service in full.

Why. Proving the consent you gave and the terms you agreed to, and informing you of changes as the general terms require (Art. 6(1)(b), (c) and (f) GDPR; Art. 7(1) GDPR; Art. 17(3)(e) GDPR).

Your rights

Access, rectification, erasure, restriction, portability and objection, as in the general privacy policy. An informal email is enough.

You may complain to a supervisory authority; the competent one here is Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover.