{
  "subprocessors": [
    {
      "name": "AWS RDS (PostgreSQL)",
      "purpose": "primary tenant data store",
      "dataCategory": "all tenant data (encrypted at rest)",
      "region": "us-east-2"
    },
    {
      "name": "AWS ECS (Fargate)",
      "purpose": "web application + scanner task execution",
      "dataCategory": "scan metadata (cloud account IDs, scan status)",
      "region": "us-east-2"
    },
    {
      "name": "AWS SES",
      "purpose": "transactional email (magic-link sign-in)",
      "dataCategory": "email address",
      "region": "us-east-2"
    },
    {
      "name": "AWS Secrets Manager",
      "purpose": "application + webhook secret storage",
      "dataCategory": "no customer data (secrets only)",
      "region": "us-east-2"
    },
    {
      "name": "AWS CloudWatch Logs",
      "purpose": "operational logging",
      "dataCategory": "request metadata (no secrets, no email)",
      "region": "us-east-2"
    },
    {
      "name": "AWS Application Load Balancer",
      "purpose": "HTTP request routing",
      "dataCategory": "none (transport only)",
      "region": "us-east-2"
    },
    {
      "name": "AWS CloudFront",
      "purpose": "content delivery / TLS termination",
      "dataCategory": "none (transport only)",
      "region": "global"
    },
    {
      "name": "AWS ECR",
      "purpose": "container image registry",
      "dataCategory": "none (no customer data)",
      "region": "us-east-2"
    },
    {
      "name": "cdn.jsdelivr.net",
      "purpose": "serves the cytoscape.js graph library on relationship-graph pages",
      "dataCategory": "none (static JavaScript asset)",
      "region": "global CDN"
    }
  ],
  "dataCollected": [
    {
      "category": "account identity",
      "fields": [
        "email",
        "display preferences (timezone, dyslexic font)"
      ],
      "storedIn": [
        "disco.users"
      ],
      "retention": "for the life of the account; removed on account deletion"
    },
    {
      "category": "network identifiers",
      "fields": [
        "ip",
        "user_agent"
      ],
      "storedIn": [
        "disco.sessions",
        "disco.magic_links",
        "audit_log"
      ],
      "retention": "session/magic-link rows expire and are purged; audit rows follow the organization audit-retention policy"
    },
    {
      "category": "cloud connection metadata",
      "fields": [
        "cloud_account_id",
        "principal (role ARN / subscription / service account)"
      ],
      "storedIn": [
        "connected_accounts"
      ],
      "retention": "until the connected account is removed; no cloud credentials are ever stored"
    },
    {
      "category": "scan results",
      "fields": [
        "discovered cloud resources, relationships, and scan status"
      ],
      "storedIn": [
        "per-tenant resources / relationships / scans"
      ],
      "retention": "until deleted by the customer or the workspace is removed"
    }
  ],
  "retention": [
    {
      "what": "sign-in magic link",
      "duration": "15m0s",
      "source": "internal/auth.MagicLinkTTL"
    },
    {
      "what": "session (absolute)",
      "duration": "12h0m0s",
      "source": "internal/auth.SessionTTL"
    },
    {
      "what": "session (idle)",
      "duration": "1h0m0s",
      "source": "internal/auth.SessionIdleTimeout"
    },
    {
      "what": "audit log",
      "duration": "365 days (per-organization configurable, 30–36500)",
      "source": "disco.app_settings system_audit_retention_days / disco.tenants.audit_retention_days"
    },
    {
      "what": "deleted account/workspace (recovery window before permanent removal)",
      "duration": "14 days",
      "source": "views.PurgeGraceDays"
    }
  ],
  "tracking": {
    "analytics": false,
    "thirdPartyTrackers": false,
    "dataSold": false,
    "adTech": false
  },
  "securityPosture": [
    "credential-less cloud access (AWS AssumeRole, Azure Lighthouse, GCP Workload Identity Federation) — no customer cloud secrets are stored",
    "schema-per-tenant isolation with forced row-level security",
    "append-only, hash-chained audit log",
    "magic-link authentication — no passwords are stored",
    "strict Content-Security-Policy; no third-party analytics or trackers",
    "encryption at rest via managed-database KMS, plus row-level security and schema-per-tenant isolation; application-level field encryption has been evaluated and is not yet implemented"
  ],
  "openSource": {
    "engineRepo": "https://github.com/icearp/disco-cli",
    "license": "MIT",
    "split": "scanner engine open source; SaaS web application, connectors, and control plane proprietary",
    "note": "the engine that assumes roles in your cloud is open source — audit it yourself"
  },
  "contentSecurityPolicy": "default-src 'self'; script-src 'self' https://cdn.jsdelivr.net; style-src 'self' 'sha256-pgvDUBa4IjFA2yuSJ2cqcyxmNYJMborsd0ORcRv9vw8='; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'; upgrade-insecure-requests",
  "build": {
    "sha": "5e0c4ae",
    "time": "2026-08-14T19:12:30Z"
  },
  "_comment": "Generated from source constants at build time. See TRANSPARENCY.md."
}