SEK SystemsDocs Open console

Reference

Privacy and compliance

The full privacy policy is at sek.systems/privacy (English and Dutch). This page summarises what matters for operators.

Roles

  • For data about your systems (inventory, vulnerabilities, remediation), your organisation is the controller and SEK Systems the processor, under a data processing agreement.
  • For the accounts and the security of the platform itself (sign-ins, sessions, platform logs), SEK Systems is the controller.

What is collected

  • About users: name, e-mail or user name, role and environments; a password hash (never the password); the public key of registered security keys (the private part never leaves your device); sign-in times, IP address and browser version for security; and the audit log of what you approved or changed.
  • About hosts: technical facts, listed in detail in What the agent collects. Not collected: file contents, process arguments, environment variables, passwords, browsing history, and the addresses of outbound connections. Serial numbers and MAC addresses are only stored as a pseudonym.

Where and how long

  • Data is stored and processed within the European Economic Area.
  • Data of different organisations is strictly separated (tenant isolation).
  • No data is shared with third parties unless the law requires it. Vulnerability data is downloaded from public sources; no customer information goes out in the process.
  • Inventory and vulnerability data are kept as long as your organisation uses the service, and deleted after the service ends. IP addresses in session and security logs: 90 days. See the privacy policy for the details.

Websites and documentation

sek.systems and this documentation site use no cookies, no analytics, and no external scripts or fonts. The theme choice on this site is stored only in your own browser. The web server logs technical access data for security.

Compliance support

SEK Systems produces evidence that helps with:

  • NIS2 (vulnerability handling, patch management, logging of changes);
  • ISO/IEC 27001 (technical vulnerability management, change management, logging);
  • CIS Controls v8 (software inventory, continuous vulnerability management, secure configuration).

Reports → Compliance evidence shows per control the verdict and the records in SEK Systems that support it, as a signed PDF if you want. Organisational measures outside SEK Systems are not judged. SEK Systems supports your compliance; it does not certify it. The same goes for benchmarks: aligned with, not certified.