Privacy notice
Last updated 29 October 2026
Who we are
AuthLens is run by VERIDYNE SOLUTIONS S.R.L. (CUI 51635423, Trade Register J2025027184005, EUID ROONRC.J2025027184005), Str. Guliver 13, bl. C1, sc. 1, et. 5, ap. 49, Sector 6, Bucharest, Romania. We are the controller of your account data and the processor of the tenant configuration you ask us to assess. Contact: solutions@veridyne.eu.
What we collect
- Your account: name, email address and sign-in identifier, from your sign-in with email or Google.
- Tenant credentials: the client ID and secret of the read-only app you create in your tenant. The secret is encrypted with AES-256-GCM and only decrypted to start a run.
- Tenant configuration: settings, applications, connections, APIs, roles, Actions metadata, log streams and similar configuration read through the vendor's management API. Action code is never stored: it is replaced by a hash before anything is saved, and values that look like secrets are removed.
- Results: findings, scores and run statistics.
- Access requests: the name, work email, company, platform and message you send with the request-access form, so we can set up your account and reply.
AuthLens does not read end users, their profiles or logs of their sign-ins. It never writes to your tenant.
Why, and on what basis
We use this data only to provide the assessment you ask for (performance of a contract, GDPR Art. 6(1)(b)) and to keep the service secure (legitimate interest, Art. 6(1)(f)). We do not sell data, show ads or use your data to train models.
How long we keep it
- Raw configuration reads: 30 days, then deleted automatically.
- Findings, scores and the encrypted credential: until you disconnect the tenant or delete your data in Settings. Both take effect immediately.
- Your sign-in account: until you ask us to remove it.
- Access requests: in our mailbox for up to 12 months, or as long as you have an account.
Who processes it
| Subprocessor | Purpose | Location |
|---|---|---|
| Vercel Inc. | Hosting and running the application | Frankfurt, EU (fra1) |
| Neon (Databricks) | Database | Frankfurt, EU |
| Okta Inc. (Auth0) | Sign-in to AuthLens | EU |
| Resend Inc. | Sending access-request emails and their confirmation | United States (SCCs) |
| OSV.dev (Google) | Known-vulnerability lookup for npm packages used in Actions. Only package names and versions are sent. | Global |
Where a subprocessor is outside the EEA, transfers rely on the EU–US Data Privacy Framework or Standard Contractual Clauses.
Your rights
You can access, correct, export or delete your data, object to processing, and complain to the Romanian supervisory authority (ANSPDCP, dataprotection.ro). Most of this you can do yourself in the app; for anything else write to solutions@veridyne.eu.
Cookies
One encrypted session cookie keeps you signed in. Your theme choice is kept in your browser. There are no analytics or advertising cookies.