Roles
For the documents, correspondence and client data you put into Casa Conect, you are the controller and Casa Conect is your processor. We process that content to provide the service to you. For account and billing information, Casa Conect is a controller.Keeping content out of analytics
We measure how the product is used so that we can improve it. We have built the measurement so that it cannot see your content.Usage events are scrubbed on the server
Usage events are scrubbed on the server
Before any usage event is recorded, fields that could carry content or secrets are removed whatever the code that sent them intended. This covers text, body, content, HTML, Markdown, email, name, phone, address, prompt, question, answer, feedback, note, message, subject, URL, password, token and secret, among others. Remaining text values are cut to 200 characters and lists to 50 items.
Session replay masks everything by default
Session replay masks everything by default
Session replay helps us understand where people get stuck. In Casa Conect, every piece of text is replaced with asterisks unless we have explicitly marked it as our own interface copy, such as a menu label. All form inputs are masked. Element attributes are masked. Network request headers and bodies are not recorded. Embedded frames from other origins are not recorded.
Content areas are blocked, not just masked
Content areas are blocked, not just masked
The parts of the screen that show your material are excluded from replay altogether: editor bodies, document viewers, email bodies, conversations with the agent, matter descriptions, summary values and share pages. Our engineering rules forbid unmasking anything that renders customer content.
Profiles only for signed-in users
Profiles only for signed-in users
Analytics profiles are created only for identified, signed-in users. Analytics data is hosted in the EU.
Error reports carry shapes, not values
Error reports carry shapes, not values
When a server error is reported, the request’s inputs are reduced to their types and field names. The values are never attached.
Deleting data
Deletion is ordered so that it cannot be silently reversed. The identity is removed first, then the local record, and a marker prevents a late message from the identity provider from recreating what was just deleted.
Backups. Deleted data remains in encrypted backups until those backups expire, which takes a matter of weeks for daily backups and longer for monthly ones. Backups are used only for disaster recovery. Previous versions of files are removed on a fixed schedule.
What is not yet available
We would rather you know than assume.- Self-service data export. There is no one-click export of an account or organization. Individual documents can be downloaded at any time. For a bulk export, contact us.
- A single erasure request across every system. Deletion works per item, per account and per organization, as described above. For a formal data-subject request, contact us and we will carry it out and confirm.
- Configurable retention periods. Data is kept until you delete it.