Privacy Policy
Last updated: 21 October 2026
1. Controller and scope
CloudExp OÜ, Estonian registry code 16263842, registered address Juurdeveo tn 18-9, Kesklinna linnaosa, 11313 Tallinn, Harju maakond, Estonia (“we”, “us”), acts as controller for personal data relating to visitors to securityserver.io (see section 3), account users and customer communications. Privacy enquiries: support@securityserver.io.
This policy does not independently govern the content of messages exchanged through a customer’s X-Road security server. For that data, the customer generally determines the purposes and means of processing and we act as its processor under the Data Processing Agreement. The respective controller roles of the customer and its counterparties depend on the particular exchange.
2. Categories, purposes and legal bases
| Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| Email address, authentication ID, password hash or external sign-in ID | Account registration, authentication and administration | Contract (6(1)(b)); where appropriate legitimate interests (f) |
| Organisation name, registration number, contact and invoicing information | Customer management, billing and tax compliance | Contract (b), legal obligation (c), legitimate interests (f) |
| Stripe customer and payment identifiers, subscription status and invoices | Billing and subscriptions | Contract (b), legal obligation (c) |
| Server names, configuration, certificate metadata, health and action history | Service provision, administration, troubleshooting and security | Contract (b), legitimate interests (f) |
| Login and security information including IP addresses and failed attempts | Abuse prevention and systems security | Legitimate interests (f), applicable legal obligations (c) |
| Support requests and correspondence | Providing assistance and managing claims | Contract (b), legitimate interests (f) |
| Technical error events and monitoring metrics | Reliability and debugging | Legitimate interests (f) |
| Website visit statistics (see section 3) | Understanding and improving the website | Legitimate interests (f) |
| Contact details for operational notifications | Billing, security and certificate notices | Contract (b), legitimate interests (f) |
Where the contracting customer is a legal entity, contract necessity is not always the appropriate basis for processing its employees’ personal data; legitimate interests or a legal obligation may apply instead. We do not store full payment card numbers in the dashboard; Stripe processes card payments.
We do not sell personal data, use service data to build advertising profiles or carry out solely automated decisions producing legal or similarly significant effects for users.
3. Visit analytics
We measure visits to securityserver.io and the dashboard at app.securityserver.io with Umami Cloud, operated by Umami Software, Inc. (San Francisco, California, USA), as our processor.
- Data: pages viewed, referrer, browser, operating system, device type, approximate location, and our own click events on sign-up and sign-in links. In dashboard page addresses we replace server IDs with a placeholder before sending.
- Use: we do not use this data to identify individual visitors and do not combine it with account data.
- Cookies and IP addresses: the Umami tracker does not use cookies. Umami does not store visitor IP addresses as analytics fields; it processes them briefly to derive a visitor identifier and approximate location. IP addresses may also remain in Umami’s operational and security logs.
- Transfers: Umami’s data may be processed in the USA and by its sub-processors. Transfers rely on the EU Standard Contractual Clauses in Umami’s data processing agreement. Its sub-processors are listed at umami.is/subprocessors.
- Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in understanding and improving the website and the dashboard. You may object, see section 8.
4. Recipients and service providers
We use these service providers (processors):
- Supabase: sign-in and the account database.
- Vercel: hosting of the dashboard.
- Stripe: payments, subscriptions and invoices.
- Nuntly: sending service emails.
- Sentry (Functional Software): technical error reports.
- Grafana Labs: monitoring of the service.
- Hetzner: servers that run the security servers.
- Cloudflare: network tunnel and backup storage.
- Google Cloud: second copy of backups.
- Umami Software, Inc.: visit analytics for the website and the dashboard.
- Google and GitHub: only if you choose to sign in with them.
We limit disclosures to what is needed and enter into data protection terms where required.
We may also disclose information to professional advisers, public authorities or others where legally required or justified.
5. Transfers outside the EEA
We prefer processing in the European Economic Area. Some international providers may, however, access or receive data outside the EEA. Where this happens, we use appropriate legal transfer mechanisms, such as an adequacy decision (including a valid EU–US Data Privacy Framework certification where applicable) or European Commission Standard Contractual Clauses with supplementary safeguards as needed. Contact us for details of relevant transfers and safeguards.
6. Retention
Account and service administration records are retained while needed to provide the service and, after closure, to meet legal obligations, resolve claims and address security incidents. After a server is deleted, we keep a minimal server record and the escrowed access key for that server. Some data is kept for short, fixed periods: sign-in outcomes 30 days, failed-attempt counters 1 day, one-time secret values 7 days and unfinished drafts 1 day. These are application-specific periods, not universal deletion deadlines for all corresponding personal data.
Estonian law generally requires accounting source documents to be retained for 7 years from the end of the relevant financial year. Retention of support correspondence, error reports, backups and closed-account data depends on service configuration, purpose and legal duties. Data is not kept longer than justified.
7. Security
We use access controls, encrypted transport and authentication protections. Server isolation, backups, key handling and measures for customer data are described in the service agreement documents. No form of processing can be guaranteed risk-free.
8. Your rights
Depending on the circumstances, you may request access, rectification, erasure, restriction, portability, object to processing based on legitimate interests, and withdraw consent where consent is relied upon. These rights are subject to statutory conditions and exceptions. Contact support@securityserver.io. We normally respond within one month, subject to legally permitted extensions, and may verify your identity.
You may complain to the Estonian Data Protection Inspectorate (aki.ee) or your competent local supervisory authority.
9. Cookies, children and changes
See our Cookie Policy. Our service is for organisations and is not directed at people under 18. We may update this policy and will provide appropriate advance notice of material changes where required.