Privacy Policy

AuthBoundry processes different types of data. This policy explains what data we collect, how we use it, and your rights.

Data We Collect

Account Data

Name, email, GitHub user ID, organization name, session information.

Authority Data

Policies, principals, delegations, capabilities, organization structure.

Technical Data

IP address, browser info, logs, timestamps, API requests, security events.

Authorization Evidence

Immutable records of authorization decisions (timestamp, principal, capability, decision, reason).

How We Use Data

  • Provide the AuthBoundry service
  • Create audit evidence and records
  • Monitor service performance and security
  • Respond to security incidents
  • Comply with legal obligations
  • Enforce these Terms

Your Rights

  • Access: Request what data we hold about you
  • Portability: Export your data
  • Correction: Request correction of inaccurate data
  • Deletion: Delete your account and associated data (subject to retention)
  • Objection: Object to certain processing

Data Retention

  • Account data: Deleted 30 days after account deletion
  • Policies: Deleted 90 days after account deletion
  • Technical logs: Retained 30 days (90 days for security events)
  • Authorization evidence: Retained 3 years (longer if required by law)
  • Backups: Retained 30-90 days per backup policy

Full Policy

See docs/legal/PRIVACY_POLICY.md for the complete Privacy Policy.

See docs/legal/DATA_RETENTION_DELETION.md for detailed data retention and deletion procedures.

Questions? Contact [email protected]