Data protection in practice
This page is aimed at anyone who needs to assess WF SecurityCloud from a data protection perspective — as an IT manager, data protection officer or procurer.
Who is what
When you are a customer of ours, two different relationships arise, and they should be kept apart.
Your account with us
For details about your account — contact person, billing details, licences — Webbfabriken AB is the data controller. We determine why and how they are processed, and that is described in the privacy policy.
Data passing through the service
For data arising when the protection runs on your devices — above all blocking events containing IP addresses — we process data on your behalf. There you are the controller and we are the processor.
Data processing agreement
If you need a data processing agreement, we will sign one. Get in touch and we will send our template, or review yours if you have one that has to be used.
The agreement governs what we may do with the data, which security measures apply, how we handle an incident and what happens to the data when the agreement ends.
Why the volume is small to begin with
The best way to protect data is not to collect it. WF SecurityCloud is built so that the protection works without anyone having to read the contents of your files, mail or traffic.
What is processed is, in practice, addresses and timestamps. That makes your assessment simpler: there is no large body of sensitive material to risk assess, because it never leaves your systems.
- No file contents are processed
- No email is processed
- No mapping of websites visited
- Blocking events contain address, type, time and device
Sub-processors and third countries
The service runs in Webbfabriken's own environment. The sub-processor involved in normal operations is Stripe, for payments.
If you need a current and complete list of sub-processors, stating where processing takes place and which transfer mechanism applies, we will send it on request. We would rather provide up-to-date documentation directly than publish a list on a web page that may go stale.
If something happens
If we discover a personal data breach affecting your data, we notify you without undue delay, with what we know about what happened, which data is affected and what we are doing about it.
If you suspect an incident or have found a vulnerability in our systems, see the page on security reporting.
Need documentation for a review?
Processing agreement, sub-processor list and a description of security measures are provided on request.