Privacy Policy

Controller

Rokkhe SAS, 47 rue Vivienne, 75002 Paris, France, is the controller for account, website and billing data. You can reach us at the address in the Contact section below.

Assessment targets, findings, evidence, alerts and other content you submit to a workspace are processed on your behalf. For that content you are the controller and Rokkhe is your processor; our data processing agreement is available on request.

Data we process

Account data: name, email address, sign-in records, team membership and roles.

Workspace data: configuration, assessment targets, findings, evidence, alerts, cases, integration settings and audit events that you create or connect.

Technical data: IP address, browser and request metadata, and the security logs needed to run and protect the service.

Purposes and legal basis

Providing the platform you sign up for, including sign-in, workspaces, assessments and support. Legal basis: performance of a contract (GDPR Article 6(1)(b)).

Protecting the service and its users with bot checks, rate limits, abuse prevention and audit logs. Legal basis: our legitimate interest in keeping the platform secure (Article 6(1)(f)).

Keeping accounting records and answering lawful requests from authorities. Legal basis: legal obligation (Article 6(1)(c)).

We do not sell personal data or use it for advertising.

Sub-processors and recipients

Google Cloud EMEA Limited (Ireland): hosting, in the europe-west9 region in Paris.

Cloudflare, Inc. (United States): content delivery, DNS, network protection, and Turnstile bot checks on account forms.

Resend, Inc. (United States): account emails such as address verification and password reset.

Model providers you configure, such as Anthropic or OpenAI: the assessment context needed to run your scans, sent under your own account with that provider.

Integrations you connect, such as GitHub, GitLab, Slack, Jira, Linear or Discord: only what each workflow you enable sends.

Transfers outside the EEA

Some recipients above process data in the United States. Those transfers rely on the EU–US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's standard contractual clauses.

Retention

Account and workspace data are kept while your account is open. When you close your account or ask for deletion, we delete or anonymise it unless the law requires us to keep it.

Security logs are kept only as long as needed to investigate incidents. Accounting records are kept for ten years, as French commercial law requires.

Your rights

You can ask to access, correct, delete, restrict or port your data, object to processing based on our legitimate interest, and leave instructions for what happens to your data after your death (French Data Protection Act, Article 85). Email us and we will answer within one month.

You can also lodge a complaint with the CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or online at cnil.fr.

Cookies

Rokkhe sets only the cookies the service needs: your sign-in session, your active workspace, your display theme and whether the app sidebar is open. Cloudflare may set cookies that protect the site against bots and abuse. None are used for analytics or advertising, so no consent banner is shown.

Security

The platform is built around workspace scoping, encrypted integration credentials, audit trails, least-privilege services and bounded data retention. No control removes every risk.

Contact

For questions about Rokkhe or this page, email [email protected].