Privacy policy
Last updated: 30 October 2026
This English translation is provided for convenience. Only the French version is legally binding.
Article 1 · Controller
ClearCloud, sole proprietorship (entreprise individuelle)
SIRET 539 932 731 00034 · EU VAT FR 53 539932731
21000 Dijon, France
Contact: contact@checkops.eu
For the data you send into the service (SBOMs, scanner results), ClearCloud acts as a processor on behalf of your organisation: see the DPA.
Article 2 · Data collected
Account: email address, name if you provide it, organisation and role. Sign-in goes through our own authentication server (Keycloak), operated by ClearCloud. If you choose to sign in with GitLab, GitHub or Google, that provider sends us your email address and name; we receive neither your password nor access to your repositories.
Data sent to the service: SBOMs and scanner results, with the names and versions of your components; products and releases; VEX decisions; CRA notifications and reports. These files describe software and rarely contain personal data.
Alerts: recipients' email addresses, webhook addresses and, for GitLab or Jira tickets, the access tokens you provide.
Technical data: access logs (IP address, date, request) for the security of the service, and audience statistics for the public website (see Article 6).
Article 3 · Purposes and legal bases
| Purpose | Legal basis | Retention |
|---|---|---|
| Account, organisation, data sent to the service | Performance of the contract | Until the account is deleted |
| Sending alerts | Performance of the contract | As long as the alert channel exists |
| Technical logs | Legitimate interest (security) | Limited to what security requires |
| Audience statistics | Legitimate interest | No individual identifier |
Article 4 · Subprocessors
| Subprocessor | Role | Location | Data |
|---|---|---|---|
| OVH SAS (OVHcloud) | Hosting of the platform, the database and the backups | France | All service data |
| Scaleway SAS | Sending emails (alerts, invitations) | France | Recipient email address, alert content |
Authentication (Keycloak) and audience measurement (Matomo) are operated by ClearCloud on its own infrastructure and are not subprocessors. No US provider has access to your SBOMs.
Article 5 · Security
- Encryption in transit (TLS) on all exchanges.
- API tokens stored as a hash (SHA-256): they are shown only once, when created.
- Alert channel tokens (GitLab, Jira) encrypted in the database (AES-256-GCM), with a key kept outside the database.
- Data isolated per organisation, checked on every request.
- Reporting a vulnerability: contact@checkops.eu.
Article 6 · Cookies and audience measurement
CheckOps only uses strictly necessary cookies, and measures the audience of its public website with Matomo, self-hosted by ClearCloud in France. Details in the cookie policy.
Article 7 · Your rights
- Access, rectification, portability: from the customer area, or on request.
- Erasure: deleting the account erases the organisation, its data and the sign-in account.
- Objection and restriction: contact@checkops.eu.
We reply within 30 days at most. You can also lodge a complaint with the CNIL, the French data protection authority (3 place de Fontenoy, 75007 Paris, cnil.fr).
Article 8 · Transfers outside the European Union
Service data is hosted and processed in France. The only exception, at your choice: signing in with GitHub or Google, whose publishers are established in the United States and receive the sign-in request under their own terms.