Privacy Policy

1. Who we are

TenantOne ("we", "us") provides security and governance assessments for SaaS tenants — currently Google Workspace and Atlassian (Jira/Confluence) — at tenantone.io. The service is operated by Valerii Novokhyzhnii, trading as Webdesign VALNOVO, Klosterstr. 3, 71394 Kernen im Remstal, Germany — see our Imprint for full legal details. For any privacy matter, contact us at privacy@tenantone.io or hallo@valnovo.de. Given the size and nature of our processing activities, we are not required to appoint a Data Protection Officer under Art. 37 GDPR; the contact above handles all data protection matters.

2. Scope and eligibility

TenantOne is a business-to-business (B2B) service intended for use by organizations and the IT administrators, security teams and other staff they authorize. It is not directed at, and should not be used by, individuals under the age of 18 or for purely personal or household purposes. If you register on behalf of an organization, you confirm that you are authorized to do so and that your organization has reviewed this policy.

3. What data we process

Account data: your name, email address and a hashed password when you create a TenantOne account; for team members you invite, the email address you enter and the acceptance status of the invitation.

Tenant configuration data: when an administrator connects a Google Workspace tenant, we read configuration and audit metadata through official Google APIs using read-only scopes: user directory attributes (names, email addresses, admin status, 2-Step Verification status, sign-in timestamps, recovery email/phone, organizational unit), group settings, domain records, third-party OAuth grant metadata, security-relevant audit log events, storage usage, and — where Drive scanning is separately enabled via domain-wide delegation — Drive file metadata (name, owner, sharing exposure). When an administrator connects an Atlassian site, we read configuration metadata through official Atlassian Cloud APIs using read-only scopes: Jira project attributes (key, name, lead, activity timestamps), permission schemes and project roles, group names, Confluence space attributes and activity timestamps, and installed Marketplace app metadata. If an organization administrator additionally supplies a read-only organization API key, we also read organization-level metadata: managed account attributes (Account ID, display name, email address, account status, product access and last-active timestamps), organization role assignments, API token metadata (label, owner, creation, expiry and last-used timestamps — never the token value), the authentication policy state recorded for managed accounts, and the native backup policy configuration. This organization key is optional, is stored encrypted, is never required to run an assessment, and can be removed at any time. Where an Atlassian Account ID, display name or email is stored in connection with a scan or OAuth grant, we report those Account IDs to Atlassian via the Personal Data Reporting API on a recurring cycle and erase or refresh them when Atlassian instructs us to. We do not read the content of emails, files, documents, issues or pages.

DNS data: we look up public DNS records (SPF, DKIM, DMARC, MX) for your verified domains.

Technical and session data: basic server logs (IP address, timestamp, requested URL), and, for signed-in sessions, the IP address and browser user agent associated with your login session, used for account security, fraud prevention and troubleshooting, retained for a limited period as described in Section 10.

Cancellation requests: if you use the contract cancellation form, we process the email address, optional name and optional note you provide, together with the requested termination date, to process and confirm your cancellation (see Section 12).

4. How we use it

Exclusively to evaluate your tenant's security configuration, compute findings and risk scores, display them to authorized users of your organization, generate reports, notify you about new findings, administer your account and team, and process cancellation requests. We do not sell data, do not use it for advertising, and do not share it with third parties except the recipients listed in Section 9.

5. Legal basis (GDPR)

We process account and tenant data to perform our contract with you (Art. 6(1)(b) GDPR) and, for security logging, fraud prevention and exercising or defending legal claims, on the basis of our legitimate interest (Art. 6(1)(f) GDPR). Where we send you optional product updates, we rely on your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time without affecting the lawfulness of processing before withdrawal. Processing of statutory cancellation requests under § 312k BGB is based on our legal obligation and the performance of the underlying contract (Art. 6(1)(b) and (c) GDPR).

6. Your role and ours (controller and processor)

For your account data (Section 3, "Account data"), TenantOne acts as the data controller within the meaning of the GDPR.

For personal data contained in the tenant you connect (Google Workspace or Atlassian) (e.g. your employees' names, email addresses or audit log entries), your organization is the data controller and TenantOne acts solely as a processor acting on your documented instructions, within the meaning of Art. 28 GDPR. Your organization remains responsible for having a valid legal basis to have this data processed and for informing the individuals concerned. We offer a Data Processing Agreement (DPA) reflecting Art. 28 GDPR requirements, including sub-processor authorization, confidentiality, security measures and assistance obligations; request a copy at privacy@tenantone.io.

7. Google API Services — Limited Use disclosure

TenantOne's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google Workspace data is used only to provide the security assessment features visible to you, is never used to develop or train generalized AI/ML models, and is never sold.

8. Automated processing and risk scores

Risk scores and findings are generated automatically by comparing your tenant's configuration against CIS-aligned benchmarks. This is automated processing, but it does not amount to a decision producing legal effects concerning you or a similarly significant effect within the meaning of Art. 22 GDPR: findings are informational, are reviewed by your own administrators, and require your organization's own action to be applied. We do not make any fully automated decisions about you or your organization that have legal or similarly significant effects.

9. Recipients and international data transfers

We only disclose personal data to the following categories of recipients, each acting as our processor or as an independent controller for their own service, and only to the extent necessary to provide TenantOne:

• Hetzner Online GmbH (Germany/Finland, EU) — hosting infrastructure for our application and database. Data stays within the EU/EEA.
• Google LLC(USA) — the Google Workspace Admin SDK, Reports API, Groups API and OAuth services you use to connect your tenant. Google Workspace data you authorize us to read is transmitted to and from Google's infrastructure. Google is certified under the EU-U.S. Data Privacy Framework and/or bound by EU Standard Contractual Clauses for such transfers.
• Atlassian Pty Ltd / Atlassian US, Inc. (Australia/USA) — the Jira and Confluence Cloud APIs and OAuth services you use to connect your Atlassian site. Atlassian data you authorize us to read is transmitted to and from Atlassian's infrastructure under EU Standard Contractual Clauses and Atlassian's data-transfer safeguards.
• Resend (USA) — delivery of transactional emails (invites, scan notifications, cancellation confirmations), which may involve processing on servers outside the EEA under EU Standard Contractual Clauses as an appropriate safeguard under Art. 46 GDPR.

We do not use any analytics or advertising trackers, and we do not sell or rent personal data to any third party. Where a transfer occurs outside the EEA, it is covered by an adequacy decision or by Standard Contractual Clauses (or an equivalent safeguard); a copy of the relevant safeguard is available on request at privacy@tenantone.io.

10. Storage, security and data retention

We apply technical and organizational security measures to protect your data against unauthorized access, loss or misuse. Application data, including data read from Google Workspace or Atlassian, is stored in an access-controlled database on servers in the European Union (Hetzner, Finland). All traffic to and from TenantOne is encrypted in transit via TLS. OAuth refresh tokens — the credential that grants us access to your tenant — are additionally encrypted at rest with AES-256-GCM, and access to production systems is limited to authorized personnel. You can revoke TenantOne's access at any time in the Google Admin console / Google account settings, or for Atlassian under Connected apps in your Atlassian account settings.

Retention periods:

• Account data: kept for as long as your account is active.
• Tenant scan data and findings: kept for as long as the tenant remains connected, plus a short grace period to let you re-enable access.
• Server logs and session technical data: rotated after 30 days.
• Cancellation requests: kept for the statutory limitation period applicable to contractual claims under German law (generally up to 3 years) for evidentiary purposes.
• Deleting your account triggers deletion of all associated personal data within 30 days, unless we are legally required to retain specific records for longer (e.g. invoicing or accounting obligations under German commercial and tax law).

11. Cookies

We set a small number of strictly necessary cookies, and one optional Preferences cookie that requires your consent before it is set. We do not use tracking, analytics or advertising cookies on tenantone.io or app.tenantone.io. When you first visit, a cookie banner lets you accept all cookies, reject the optional one, or open detailed settings; you can change your choice at any time via the "Cookie preferences" link in the footer or on our Cookie Policy page. The cookies we set are:

The first three cookies above are technically necessary within the meaning of § 25 (2) TTDSG / Art. 6(1)(b) and (f) GDPR and do not require consent. The sidebar_state cookie is optional and is only set after you actively opt in (Art. 6(1)(a) GDPR / § 25 (1) TTDSG).

12. Your rights

Under the GDPR, you have the right to:

• request access to the personal data we hold about you (Art. 15 GDPR);
• request rectification of inaccurate data (Art. 16 GDPR);
• request erasure of your data (Art. 17 GDPR), subject to statutory retention obligations;
• request restriction of processing (Art. 18 GDPR);
• receive your data in a portable format (Art. 20 GDPR);
• object to processing based on legitimate interest (Art. 21 GDPR);
• withdraw consent at any time, with future effect (Art. 7(3) GDPR); and
• lodge a complaint with a data protection supervisory authority, in particular the authority competent for our registered office, the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI Baden-Württemberg), or the authority in your own EU member state of residence or work.

To exercise any of these rights, contact privacy@tenantone.io. We respond within 30 days. If personal data relates to a Google Workspace tenant your organization connected, we may direct certain requests to your organization's administrator, who is the controller for that data (see Section 6).

13. Changes to this policy

We may update this policy as the service evolves. Material changes will be announced by email or in-app notice before they take effect, and the "Last updated" date above will reflect the date of the latest revision.