Privacy policy

Data controller

SafeMode is operated by Kartia IKE, a private company (Ιδιωτική Κεφαλαιουχική Εταιρεία) registered in Greece, under the trade name SafeMode Space (Dorylaiou 10-12, 11521, Athens; ΓΕΜΗ 170727601000). For the purposes of the GDPR, Kartia IKE is the data controller for this site, the self-assessment and the accounts of the people who sign in.

For the data a customer puts into the platform, such as its assets, telemetry, incidents and the names in them, the customer is the controller and Kartia IKE processes it on the customer's instructions, under a data processing agreement as Article 28 GDPR sets out.

Data collected

The site's pages collect no information directly. They carry no analytics, no advertising and no script from another company, and your activity on them is not recorded.

The self-assessment scores your answers when you send them and shows the result; nothing is stored unless you ask to be contacted. If you do, Kartia IKE keeps your email address, your organisation's name, your answers, the consent text you agreed to and the time you agreed, on your consent (Article 6(1)(a) GDPR).

For each person given an account, the platform holds their name, work email address, role and organisation, their password as a scrypt hash and never as written, and their second-factor secret where they turn one on. It records their sessions, sign-ins and failed sign-ins, with the time and the address they came from. These are needed to provide the service under the customer's agreement (Article 6(1)(b) GDPR) and to keep it secure, on a legitimate interest (Article 6(1)(f) GDPR).

Every change made through the platform and every sign-in is recorded in an audit trail with who made it, when, and from which address. The trail is append-only and chained by hash, as evidence of the customer's own duties, so its rows are not edited or removed while the customer's account runs.

What the host can see

The platform is served by its host, OVHcloud, from a data centre in Frankfurt, Germany, through SafeMode's own web server. They process the technical details required to deliver the request: the IP address, the page requested, the time and the browser's user-agent string, and use them for delivery and network security.

No analytics product is attached to this traffic, and readers are not profiled. Under the GDPR, the lawful basis for this processing is legitimate interest in delivering and securing the service.

Cookies and local storage

One cookie is set, and only when you sign in: the session. The cookie policy describes it, with the settings the platform keeps in your browser's storage.

Who else receives data

The platform sends mail through the provider its deployment sets, an SMTP server over TLS or Resend, which receives the recipient's address and the message under a data processing agreement; where neither is set, no mail is sent. Where an organisation's administrator turns it on, the platform also sends the package names and versions of the organisation's software components to OSV (osv.dev), and where the deployment names a timestamping authority, the hash of the audit chain's head; neither carries personal data.

Where a provider handles data outside the European Economic Area, such as Resend in the United States, the transfer rests on a safeguard of Chapter V GDPR: an adequacy decision of the European Commission or its standard contractual clauses. Kartia IKE sells no personal data and shares none for advertising.

How long data is kept

A self-assessment contact: twelve months from consent, deleted by a daily job, or at once through the deletion link mailed to you. An account and its records: while the customer's agreement runs, then deleted with the customer's data. A session: 24 hours at most, ended earlier at sign-out, deactivation or a change of role.

Links to other sites

Pages link to the sources they name, including SafeMode Reference, SPARTA and LinkedIn. No content is embedded from these sites, and no request is made to them until a reader follows a link. After that, the other site's privacy terms apply and this policy does not.

Your rights

The GDPR gives you rights of access, rectification, erasure, restriction, portability and objection over personal data held about you, and where a use rests on your consent you may withdraw it at any time. Contact Kartia IKE as the data controller, at hello@safemode.space. For data a customer holds in the platform, Kartia IKE passes your request to that customer, who decides on it.

You may also complain to the Hellenic Data Protection Authority (https://www.dpa.gr/en), or to the data protection authority of the member state where you live or work.

Changes

If SafeMode begins collecting other data, or uses it for another purpose, this policy will be updated before the change is deployed, and each customer's administrators are told first.