1Who we are and what this covers

This policy explains how the following company handles personal data in connection with OffSeq Pulse:

SEQ SIA (OffSeq Cybersecurity)
Reg. No. 40203410806, VAT LV40203410806
Lastādijas iela 12 k-3, Riga, LV-1050, Latvia

We act in two roles.

As controller for console accounts, billing, support, security of the service and visits to pulse.offseq.com. This policy covers that data.
As processorfor data that a customer’s enrolled devices send to Pulse. The customer, usually your employer or IT provider, decides why and how that data is processed, and our Data Processing Agreement governs our work for them. If you use a managed device, please contact the organization that manages it first; we will help them answer you.

Questions and requests: privacy@offseq.com.

2Data we collect as controller

Account data

Your name, email address, organization, role and permissions, and a hash of your password (we never store the password itself). When you sign in we record the IP address, browser user agent and time for your active sessions and trusted browsers, and we send one-time sign-in codes by email.

Billing data

Company or contact name, billing email, country, VAT and company registration numbers, the type and a short label of your payment method, the card’s issuing country, identifiers from our payment provider, and records of payments and invoices. Our payment provider, Mollie, processes card, PayPal and other payment details; we never see or store full card numbers.

Activity in the console

State-changing actions you take in the console, such as remote actions, commands, user and setting changes, are written to the organization’s audit log with your email, IP address and browser user agent.

Support and communication

Messages you send us and our replies.

Technical and security data

Our servers and our network provider, Cloudflare, process IP addresses and request details to deliver pages and to protect the service from abuse. Rate limiting counts requests per IP address, account or device for periods of up to a day. When the application hits an error, we record a technical error report in our own error-monitoring system; it is configured not to collect personal data by default.

Website analytics

We may use Cloudflare Web Analytics on pulse.offseq.com. It counts page views in aggregate, sets no cookies and does not build a profile of you.

3Device data we process for customers

On behalf of customers, the Pulse agent sends the data below. The customer decides which devices to enroll and which features to use.

Identity of the device: hostname, a hardware or system identifier, serial number, manufacturer and model, operating system name, version, build, edition and architecture, agent version.
Security controls: the state of hardening controls such as firewall, disk encryption, antivirus, Secure Boot, pending updates, automatic updates, USB storage policy, guest account, account lockout, screen lock settings, and whether the signed-in user is an administrator.
Network: public IP address, local IP addresses, network provider and ASN when reported, and up to six nearby Wi-Fi access point identifiers (BSSIDs).
Location:approximate location (country, city) when reported and, if the device’s location services provide one, a precise position with its accuracy. Customers can also request a location on demand with the locate action.
Health and activity: CPU, memory, disk and network usage, process and listening-port counts, uptime and last boot, battery and power state, idle time and whether the screen is locked, and a hash of the signed-in user name.
Security events: for example USB storage use, changes to security settings, sign-in and privilege events, lock and unlock, power events and agent tamper signals.
Remote actions: commands an authorised user sends (lock, alarm, locate, restart, shutdown, log off, notice, remediation, remote shell) and their results, including remote shell output.

The agent does not record keystrokes, browsing history, screen contents or file contents. A remote shell runs only the commands an authorised user types, and only users with the remote shell permission can open one.

4Why we use it and on what legal basis

Purpose	Legal basis (GDPR)
Provide accounts, the console, support and the features you use	Contract, Art. 6(1)(b)
Take payments, issue invoices, apply the right VAT treatment	Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c)
Keep accounting and tax records	Legal obligation, Art. 6(1)(c)
Secure the service: sign-in checks, rate limiting, abuse prevention, error monitoring	Legitimate interests, Art. 6(1)(f): keeping Pulse and our customers safe
Send service and billing emails, such as sign-in codes, renewal reminders and changes to terms	Contract, Art. 6(1)(b)
Establish or defend legal claims	Legitimate interests, Art. 6(1)(f)

5Cookies

Pulse uses only cookies that are strictly necessary for signing in. They are HttpOnly and sent only over HTTPS.

Name	Purpose	Lifetime
`offseq_session`	Keeps you signed in	7 days
`offseq_pending`	Holds a sign-in while you enter the emailed code	15 minutes
`offseq_device`	Remembers a browser you chose to trust, so you are not asked for a code each time	90 days
`offseq_active_org`	Remembers which organization you are working in	30 days

We do not use advertising or tracking cookies, so we do not ask for cookie consent.

6Who processes data for us

We share personal data only with these service providers, under contracts that limit their use of it:

Hetzner Online GmbH hosts our servers and databases in Falkenstein, Germany.
Cloudflare, Inc. provides the content delivery network, reverse proxy and DDoS protection in front of Pulse.
Resend, Inc., United States, delivers our transactional email.
Mollie B.V., Amsterdam, the Netherlands, processes payments. It receives billing data only, never device data.
GitHub, Inc. hosts the agent installer files. When you download an installer, your browser is redirected to GitHub with a short-lived link, and GitHub sees your IP address.

Error monitoring runs on a GlitchTip instance operated by OffSeq in the EU, not by a third party. Backups are kept in the EU. We may also disclose data where the law requires it, for example to a court or a supervisory authority. We do not sell personal data.

7International transfers

Pulse data is stored in the EU. Cloudflare, Resend and GitHub are based in the United States and may process data there. Where that happens, the transfer relies on the EU–US Data Privacy Framework or on the European Commission’s Standard Contractual Clauses, where applicable. You can ask us for details at privacy@offseq.com.

8How long we keep data

Account and organization data: while the account exists. After deletion, within 30 days, and from backups within a further 30 days.
Sessions: 7 days; trusted browsers 90 days; sign-in codes 10 minutes.
Audit log: 18 months (549 days).
Invoices and payment records: as long as Latvian accounting and tax law requires.
Support messages: as long as needed to handle the request and any follow-up.

Device data is kept according to the customer’s settings, within the limits in the Data Processing Agreement.

9Your rights

Under the GDPR you can ask us to:

give you a copy of your personal data;
correct data that is wrong;
delete data, or restrict how we use it;
give you your data in a portable format;
stop processing based on legitimate interests, unless we have compelling grounds to continue.

Email privacy@offseq.com. We answer within one month and may need to confirm your identity first. For device data, we pass your request to the customer that controls it.

You can also complain to a supervisory authority, in Latvia the Data State Inspectorate (Datu valsts inspekcija), or the authority where you live or work.

10Security

Traffic to Pulse is encrypted with TLS. Passwords are stored as bcrypt hashes; sessions, API tokens, enrollment tokens and device secrets are stored only as hashes. Sign-in from a new browser needs a one-time code sent by email, access in the console follows roles and permissions, and operator actions are written to an audit log. The annex to the Data Processing Agreement lists our measures in full.

11Children

Pulse is a service for organizations and is not directed at children.

12Changes to this policy

We update this policy when our processing changes. We email account owners about material changes before they take effect. The date at the top shows the current version.

13Contact