What we collect, and what we do with it.

Who we are and what this covers

ROGUENODE_ (“we”, “us”) provides security monitoring for organizations. This policy covers the ROGUENODE_ application at app.roguenode.ai, our API, and this website. It explains what we collect, why, who processes it on our behalf, how long we keep it, and what you can do about it.

When an organization connects its systems to ROGUENODE_, that organization decides what to connect and controls the data. We process that data to provide the service to that organization.

Information we collect

Account information

Your name and email address, and the organization you belong to. If you sign in with Google, we receive your basic Google profile (name, email address, profile picture). If you sign up with an email address, we store a salted hash of your password, never the password itself.

Data from systems your organization connects

An administrator chooses which systems to connect. Depending on that choice, we read:

• Google Workspace: admin audit reports (sign-in activity, admin console activity, and which third-party apps people signed in to with Google), using the read-only scope admin.reports.audit.readonly; and, for the asset inventory, the list of mobile and ChromeOS devices your organization manages (device model, operating system and version, management status, last sync time, the Google account listed on the device, and on Android the installed apps and their versions), using the read-only scopes admin.directory.device.mobile.readonly and admin.directory.device.chromeos.readonly; and, for security configuration checks, each user's account status (email address, whether they are an administrator, whether 2-Step Verification is enrolled and enforced, whether the account is suspended or archived, and their organizational unit) using admin.directory.user.readonly, your organizational units using admin.directory.orgunit.readonly, administrator roles and who holds them using admin.directory.rolemanagement.readonly, and your security policy settings (password, 2-Step Verification, session length, and legacy sign-in) using cloud-identity.policies.readonly. We never request passwords, recovery information, or sign-in tokens. We do not read email, files, or calendar content, and we cannot change anything in your Google Workspace.
• GitHub: through the ROGUENODE_ GitHub App, with read-only access to repository administration and metadata: each repository's branch protection, rulesets and security settings (such as secret scanning), its collaborators, and, for organizations, the organization's security settings, its administrators, and which fine-grained personal access tokens have access (not the token values). We never read code, and we cannot change anything in GitHub.
• Microsoft 365 / Entra ID: audit logs and directory information, using the read-only permissions AuditLog.Read.All and Directory.Read.All.
• Google Cloud: audit and platform logs, using the read-only scope logging.read.
• Endpoint and network security tools (such as CrowdStrike, SentinelOne, and Cisco Meraki), and events your organization sends us by syslog or webhook: the security events those tools report.

These events can include user names, email addresses, device names, IP addresses, and the actions recorded in them.

Information we derive

From those events we produce alerts, findings, and a profile of the users, devices, and addresses in your environment, including what normal activity looks like for each. This is how the service tells unusual activity from routine activity.

Service records

An audit trail of security-relevant actions taken in the application (for example, connecting a system or approving an action), and error diagnostics, described under Service providers.

Surveys on this website

If you answer a survey on this website (such as roguenode.ai/survey), we store your answers, the time you submitted them, how long the survey took, and the referral tag in the link you followed, if it had one. We do not ask for your name or email address, and we do not store your IP address or browser details with your answers.

Our hosting provider sees your IP address when you submit, as with any web request, and we use it for a few minutes to limit repeated submissions. Answers are stored in Notion, seen only by the ROGUENODE_ team, and used to decide what to build. Because they are not linked to you, we cannot find or delete one person's answers on request.

How we use it

• To detect, investigate, and report security activity in your organization's environment.
• To send you the notifications the service is for: alerts, invitations, verification and password-reset emails.
• To keep the service secure, and to diagnose and fix problems.
• To respond when you contact us.

We do not sell personal information. We do not use it for advertising. We do not use customer data to train general-purpose AI models.

AI processing

To classify a security event, we send the event (with untrusted text sanitized), related context from your environment, and similar past alerts to Anthropic's Claude API. The result is a severity, a MITRE ATT&CK technique, and a short explanation, which we store with the alert. Anthropic processes this data under commercial API terms and does not use it to train its models.

To find similar past alerts within your organization, we also convert alert text (the event's source, severity, technique and the explanation above) into a numeric representation called an embedding, using Amazon Bedrock (Amazon Titan Text Embeddings) in the United States. Embeddings are stored with the alert, compared only with your own organization's alerts, and deleted with it. Amazon does not use Bedrock inputs or outputs to train its models or share them with model providers.

Google user data

ROGUENODE_'s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, data we receive from Google Workspace:

• is used only to provide security monitoring to the organization that connected it;
• is not transferred to others except as needed to provide that service (the service providers listed below), to comply with law, or as part of a merger or acquisition with notice to you;
• is never used for advertising, and never sold;
• is never used to develop, improve, or train generalized or non-personalized AI or machine-learning models. When our AI providers classify a security event or compute a similarity embedding for your organization, they do so only to provide that result to you;
• is not read by people at ROGUENODE_ unless you ask us to (for example, for support), it is necessary for security or legal reasons, or it has been aggregated and anonymized for internal operations.

Service providers

We use these providers to run the service. Each processes data only on our behalf:

• Supabase — database (United States).
• Amazon Web Services — log storage, message queues, backups, transactional email, and text embeddings for finding similar past alerts (Amazon Bedrock) (United States).
• Railway — application hosting (United States).
• Vercel — web hosting.
• Notion — storage of anonymous answers to surveys on this website.
• Anthropic — AI classification of security events, as described above.
• Sentry — error diagnostics for our own software. We configure it not to attach IP addresses or cookies, and we do not record user sessions. An error report describes a failure in our code and can include personal information that was part of that failure, such as an email address.
• Slack — only if your organization connects it, to deliver alerts to your workspace.

We may also disclose information when required by law.

Security

Data is encrypted in transit and at rest. Each organization's data is isolated from every other organization's by the database itself, not only by application code. Credentials for connected systems are encrypted with AES-256-GCM before they are stored, and are never returned by our API. More detail is on our Trust Center.

How long we keep it

• Raw logs received from connected systems: deleted automatically after 30 days.
• Alerts, findings, and the audit trail: our policy is to keep them for up to 7 years, moving them to archival storage after 3.
• Account, connection, and environment profile data: kept while your organization uses the service.
• Backups: kept for 35 days.

Your choices

• Disconnect a system at any time. We revoke our access with the provider where it supports that, and destroy the stored credentials.
• Export your organization's data from the application.
• Delete your organization. This deletes its data, except the audit trail of actions taken, which we keep as a compliance record. Deleted data leaves our backups within 35 days.
• Access or correct your personal information, or ask any question about it, by emailing privacy@roguenode.ai.

If your data reached us through your employer's connected systems, your employer controls it, so please contact them first. We will help them respond.

Children

ROGUENODE_ is a business service and is not directed to anyone under 16.

Changes to this policy

If we change this policy, we will update the effective date below. If a change materially affects how we use data you have already given us, we will notify account owners by email before it takes effect.

Contact

Questions about this policy or your data: privacy@roguenode.ai.