Data processing terms

These terms apply when you put personal data on a Vexelia service and we process it for you. Vexelia LLC is the processor and you are the controller for the contents of your servers, volumes, backups and snapshots. For your account and billing data we are the controller: see the privacy notice. These terms are part of the terms of service.

What we do

• Subject and duration. We store and run what you put on the service for as long as the service runs for you. After a server is destroyed its disk is deleted after 72 hours. Backups are deleted by their retention schedule.
• Instructions. We process that data only to provide the service, on your instructions given through the panel and the API, and as the law requires.
• Confidentiality. We do not look at the contents of your servers unless you ask for support that needs it or the law or a serious abuse report requires it. Staff actions on an organisation are logged.
• Subprocessors. The ones that handle your servers' contents are listed under subprocessors. We email the account's owners 30 days before we add or replace one.
• Your requests. The panel lets you export and delete your data (see data export and deletion). If a person asks us for data in your servers, we send them to you.
• Incidents. If we learn of a breach of the personal data we process for you, we tell the account's owners without undue delay, with what we know.
• Deletion or return. When you end the service, you can export what the panel holds and delete your servers, volumes and snapshots. Backups of a destroyed server go after their retention.
• Audits. On reasonable request we give you the information needed to show we follow these terms. Ask support@vexelia.com.
• Transfers. Where processing is outside your country, including in the United States, you are responsible for any transfer mechanism your law requires of you, and we will sign one on request where it applies to us.

Security measures in the product today

• Passwords are stored as hashes. Authenticator apps and passkeys are supported, and an organisation owner can require them. Changes that matter ask for a recent password check.
• Every customer request is checked against your organisation, and API tokens are limited to one organisation and to scopes.
• Backups are encrypted.
• An audit log records account and staff actions and cannot be edited afterwards.

Annex: data we hold

What personal data we store

We do not store a phone number or run analytics on this website.

How long we keep it

• Text of emails we sent you: 30 days. Recipient, subject and status of those emails: 365 days.
• Inbound support email held for processing, and finished webhook deliveries: 30 days.
• Closed console sessions (who, when, from where): 365 days.
• Expired sessions, used or expired email links and sign-in challenges: 30 days after they expire.
• Sign-in history for alerts (browser string, network, first address): up to a year after last use.
• Data export archives you request: 7 days.
• Invoices, credit notes, the ledger, tax records, payments and refunds: kept as tax and accounting law requires, 10 years by default. They are not deleted when you delete your account.
• Our audit log: kept. It is append-only and holds an internal id rather than your name.
• Support tickets and their files: kept for now, with no automatic deletion.
• A server that is not paid for is stopped, and deleted with its data no sooner than 30 days after the due date.
• Backups of our own database and off-site copies keep erased data until each copy expires. We do not edit a backup.

Who else handles it (subprocessors)