Privacy policy

Who this policy covers

This policy explains what information BlueFennick collects, how we use it, who else handles it, and the choices you have. It covers this website (www.bluefennick.com) and the BlueFennick compliance platform, including its sign-in page at portal.bluefennick.com.

BlueFennick is in prelaunch. The platform is available by invitation or approved request only, and some features described here are being introduced gradually or are not yet available to every organization. If your organization has signed a separate agreement with us, that agreement controls where it differs from this policy.

Information we collect

On this website. The website has no forms, no analytics and no advertising. It sets no cookies. Cloudflare delivers the site and, like any hosting provider, handles basic connection data such as your IP address in order to deliver pages and protect the site.

When you email us. If you write to [email protected] or [email protected], we receive your email address and whatever you send. Please do not send credentials, sensitive evidence or regulated data by email.

When you request access. The Request access form on the sign-in page asks for your name, work email address and company, and optionally a note about what you need. A person at BlueFennick reads each request and replies from their own mailbox.

When you sign in. You sign in with Google, with Microsoft, or through your company’s single sign-on (SAML). The sign-in provider tells us who you are, so we receive your email address, an identifier the provider uses for you and, where the provider supplies it, whether your email is verified. For Google Workspace, we also receive your Workspace domain. For Google we ask only for the basic sign-in scopes (openid, email and profile). We do not ask for access to your Google Drive, Gmail, Calendar or any other Google data. We never see your Google or Microsoft password.

About your organization. We keep a record for each organization: its name, its users and their roles, how it signs in, and the invitations we create for it. We keep only a hash of the token inside an invitation, not the token itself.

When you use the service. We keep a session so you stay signed in, and an access log that records who acted, in which organization, on what, and with what outcome. The access log is append-only and tamper-evident. If you send us a support request or feedback by email, we keep what you wrote and our replies.

Your cloud configuration data

The platform’s main job is a read-only assessment of the systems an organization chooses to connect, starting with Oracle Cloud Infrastructure (OCI) tenancies. When an organization makes a connection, we read configuration settings and related information about that system, and we compare them with the requirements of the frameworks the organization has chosen. The assessment does not change your systems.

What we store from that work:

• The results of each scan: what each check found, for which resource, and since when.
• Supporting files each scan produces, and the issues, owners and deadlines built from the results.
• Documents your organization chooses to add to answer a request, and the audit packages that can be built from results and documents.
• A reference to the credential that makes the connection. The credential itself is kept in a separate secret vault, not in the platform’s main database.

Results can include the names of resources, users and groups in the connected system. Because a connection is made by your organization, please make sure you have the right to connect it and to share that information with us. During prelaunch, customer connections are being introduced gradually.

Frequent automated checks keep most of their files only for a short time, with the exceptions described under How long we keep information. Scans an organization runs or schedules itself are kept as the organization’s record.

How we use information

We use information to let you sign in and to run the service for your organization; to run assessments and show you the results; to review access requests and answer support questions; to keep the platform secure and investigate misuse; to meet legal obligations; and to improve and fix the service. We do not sell personal information, and we do not use it for advertising.

Where your organization’s customer data is concerned (the data about your connected systems, your results and your documents), your organization decides what to connect and why. We handle that data on your organization’s behalf and on its instructions, to provide the service, and not for our own purposes. In data protection terms, your organization is the controller of that data and BlueFennick is its processor. For the information we collect about you in order to run sign-in, access requests, security and the website, BlueFennick decides how it is used.

Who else handles your information

We use a small number of service providers to run the platform. We name only those we rely on today.

• Oracle Cloud Infrastructure hosts the platform: its servers, databases, file storage, secret vault and backups.
• Cloudflare provides the network edge for bluefennick.com and the platform (including security protections and encrypted connections) and hosts this website.
• Google and Microsoft act as sign-in providers when you choose them. They handle your sign-in under their own privacy policies, and your company’s single sign-on provider does the same if you use it.

The platform does not send email today. If we begin to send email from the platform, we plan to use OCI Email Delivery, and we will update this policy and list it here before any customer email is sent.

We share information with people at your organization according to the roles its administrators set. If your organization gives a partner or an outside auditor access, they can see only what that access allows. We may disclose information when the law requires it or to protect the security of the service. If BlueFennick is ever part of a merger or sale, we will make sure the information stays protected by commitments no less protective than these.

Cookies

We use only the cookies that sign-in needs. When you sign in, the portal sets a session cookie that is tied to its own address, is not readable by scripts on the page and lasts no more than 12 hours (and ends after 60 minutes of inactivity). During a Google or Microsoft sign-in, a short-lived cookie protects the sign-in from being tampered with and is cleared when the sign-in finishes. We do not use advertising, analytics or tracking cookies.

How long we keep information

• Quick checks: the results of frequent automated checks that are marked to expire, and the files they produced that no kept record uses, are deleted 7 days after they finish. Files that opened or closed a status, or that a kept record still relies on, are kept longer. The record that the check ran is kept.
• Scans and results kept as your organization’s record are kept until the organization is closed, or until we delete a whole scan at your organization’s request.
• Sign-in records: a sign-in request lasts at most 10 minutes. Spent sign-in records and sessions that have ended are removed by a nightly job.
• Backups are made nightly and kept for 30 days. When we delete data from our active systems, a copy can remain in a backup until that backup expires, up to 30 days later.
• Logs and other records: we have not yet set fixed periods for the access log, change logs, decided access requests and the status history. We will state the periods here once they are set.

When an organization’s account is closed, our policy is that sign-in stops, we stop reading from its connections, we keep its data for 30 days and work with the organization to provide a copy of it (such as its results, documents and audit package), and then we erase it from our active systems, with copies in nightly backups expiring within 30 days after that. A closure can be reversed until erasure begins. Audit logs are kept under our retention policy rather than erased with the rest. We may change the 30 days in an agreement with your organization. The tools to carry this out are still being built. Until then, we handle any closure request directly with the organization’s administrator.

If you ask us to delete your personal data, as described under Your choices and rights, we will respond and act on the request as our erasure processes allow, and tell you what we did. Our tooling for erasing an individual’s data is still being completed. Backup copies expire as described above.

How we protect information

We use measures suited to the service. In general terms: connections to the platform are encrypted in transit; each organization’s records are separated from every other organization’s by the database itself; when connections are made, their credentials are kept in a secret vault, apart from the main database; sign-in uses your provider’s own protections, including multi-factor authentication where your provider offers it; sessions are short; access to an organization’s records is limited by role and recorded in the access log; and our own staff sign in with multi-factor authentication. No system is perfectly secure, and we cannot promise that information will never be accessed without authorization. If we learn of a breach affecting your information, we will tell the affected organization as the law and our agreement require.

Your choices and rights

Depending on where you live, you may have the right to ask us to tell you what personal information we hold about you, to correct it, to delete it, to give you a copy, or to limit how we use it. To make a request, email [email protected]. We may need to confirm who you are first, and we will answer promptly.

If your information is part of your organization’s customer data, we will refer your request to your organization’s administrators and help them respond. Some records, such as the tamper-evident access log, may have to be kept to protect security or to meet legal duties; where that is so, we will tell you.

If you think we have handled your information unlawfully, you may complain to your local data protection authority or state attorney general.

Children

BlueFennick is a business service. It is not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, contact us and we will delete it.

Changes to this policy

We may update this policy as the platform changes. The effective date at the top shows the latest version. If a change is significant, we will say so on this page and notify organization administrators.

Contact us

Questions or requests about privacy: [email protected]. For general inquiries: [email protected].

Contact BlueFennick