What this server keeps about you
Draft for review. This page describes what the Cordis Studio server software stores and for how long. It is not yet a reviewed company statement.
Your account
Your email address, your username, your role and the features you have been given, and the id of your account at Auth0, the sign-in service. This is kept while your account exists and deleted when an administrator removes it.
Your current session
When you signed in, when you were last active, your IP address and your browser's description of itself. There is one session per account. It is deleted when you sign out and replaced when you sign in again.
Your activity
How many hours you used Studio, hour by hour, for 400 days. Only you can see your hours. Administrators see who is online now, not how long anyone worked. Your hours are deleted with your account.
PCs and Git credentials
For each PC you connect: its name, the label you give it and the version of the connector it runs. For each Git credential you save: the host, the repository and the username, with the token or key encrypted. Both are deleted with your account, or earlier when you remove them.
Your models
The files in your workspace. Removing your account does not delete them; they stay on the server until its operator deletes them.
The audit trail
A record of changes made to accounts: invitations, role and access changes, disabling, enabling and removing an account, password resets, linked sign-in providers, connected PCs, saved Git credentials and shared-project membership. Each entry holds the time, the email address of the person who made the change and of the account it changed, and a short detail. The audit trail has no fixed retention and is kept after an account is removed, so that a removal can still be traced.
The server log
What the server writes while it runs: sign-ins that were refused, requests that were refused or rate limited, pairing of PCs, errors, changes to accounts, and the start and any crash of each browser session. Entries can contain IP addresses, email addresses, account ids, Auth0 ids, the page that was requested, PC names, the workspace a session opened, your browser's description of itself and the languages it asks for, and a short reference code that a crash message shows you. Each entry is kept for 90 days. If the log grows past 256 MiB, the oldest entries are deleted sooner.
Why
To run the service: to sign you in, to keep your work and to show you your own account and activity. For security: to notice and stop misuse, and to find out what happened when something goes wrong.
Who can read it
Accounts with account administration, which are administrators and anyone an administrator gives that access, can read the audit trail and the server log. Project leads cannot. The people who operate the machine the server runs on can read everything it stores.
Copies
When the operator backs the server up, the backup contains the account database, the audit trail and the server log, as well as the workspaces. The backup script keeps the newest 14 backups, unless the operator sets another number. The server is also copied just before each update, and that copy is deleted once the new version is running.
Other companies
Auth0 (Okta) runs sign-in and holds your email address and your sign-in credentials. This server creates your Auth0 user when you are invited, and blocks it, rather than deleting it, when your account is removed. The company that hosts the machine this server runs on is not named here yet.
What it does not keep
Your password: you sign in at Auth0, and this server never sees it. Git tokens and keys are never written to the log.