How is GDPR handled (my personal data)?

Who is responsible for my data?

Your organization (your employer or customer) is the controller. The service provider processes the data on its behalf. Requests about your data go to your organization first.

What data is kept?

Your email, your devices' names, the public keys of your passkeys and phones, your sessions and the audit log of actions on your account. Never kept: biometric images, plain-text passwords (only a verifier) or private keys.

Can I see and download my data?

Yes. Under «My data», choose «Download my data (JSON)». See My data.

Can I correct my email?

The administrator requests the rectification; the change happens only when you confirm the new address with your passkey, within 7 days.

Can I ask for my data to be erased?

Yes, through your organization. The administrator erases the account, which is irreversible: the email is replaced by a meaningless identifier, sessions end and phones are removed. The audit log and signed receipts stay, but no longer identify you (pseudonymisation), because they are security evidence.

How long is data kept?

• Backups: 35 days.
• Technical logs: 90 days.
• Disabled accounts: the organization can erase them automatically after 30 to 3650 days without activity.
• Temporary sign-in requests: minutes to a day.

Where is the data?

In the European Union. See Where is the data?.

Who handles a GDPR request?

Access, rectification and erasure requests must be answered within one month. An automated assistant does not handle erasure requests: they are always passed to a person.