Privacy notice

Openn Shield is run by The Openn Group, a sole proprietorship registered in India and owned by Amit Singh Rawat, in Bengaluru, Karnataka, India (“we”).

For the people who sign up and run a workspace, we decide how their account data is used: under the GDPR we are the controller, and under India’s Digital Personal Data Protection Act 2023 the data fiduciary. For what a customer records in its workspace (its AI tool register, policies, risks, team list), the customer decides; we handle that data only to run the service, on its instructions.

• Account: your email address and name, the workspaces and roles you belong to. There is no password: you sign in with a code sent to your email.
• Two-step sign-in, if you turn it on: your authenticator secret (encrypted) and your recovery codes (stored as hashes only).
• What your workspace enters: the AI tool register, confidential keywords, policies and who agreed to which version, risks and notes.
• Saved scan summaries, only when someone clicks Save: counts per rule, the rule set version, whether it was pasted text or a file and which type, its size, who and when.
• Security records: the IP address and browser of each sign-in session, attempts used to stop guessing, and the workspace’s activity trail.
• Email records: who each email went to, what kind it was and whether it was sent; alerts shown in the app.

What we never receive: the text and files you scan. Scanning runs in your browser and the page is built so that it cannot send them anywhere. We do not sell data, show ads, use analytics in the app or train AI on your data.

Cookies: only the ones the service needs: your sign-in session, a short-lived one while you enter your code, and during the preview, one that remembers the preview key.

To run the service, keep accounts and workspaces secure, send the emails the service sends (sign-in codes and alerts), answer support and meet legal duties. Our legal basis is the contract with the customer, our legitimate interest in running a secure service, and legal obligation.

The server, database and backups are on Google Cloud in the United States. Cloudflare sits in front of the site, so requests pass through its network. Emails are sent through Amazon SES. Where personal data moves between countries we rely on these providers’ data protection terms, including standard contractual clauses where they apply.

Account details are kept while the account is open. Workspace records are kept until the workspace deletes them or the workspace is deleted. Each workspace sets how long saved scan summaries and read alerts are kept (by default one year and 180 days). The activity trail is kept for as long as the workspace exists, because it cannot be trimmed without breaking its seal.

When an owner deletes a workspace, everything it holds is erased 14 days later (the delay lets them change their mind). Server backups that contain it expire on a rolling basis after that.

Owners can download all of the workspace’s data, and delete the workspace, from Privacy in the app. Depending on where you live you can ask to see, correct, delete or take a copy of your personal data, or object to how it is used; under the DPDP Act you can also seek redress of a grievance and nominate someone to act for you. Write to privacy@theopenngroup.com from your account’s address.

Openn Shield is a tool for organisations, not for anyone under 18. When this notice changes we update the date above, and for meaningful changes we email workspace owners first. Questions, requests and grievances: privacy@theopenngroup.com.