Privacy
Privacy Policy
This policy explains what Essentriq collects, why, where it is processed and how long it is kept. It is written to match how the product actually works. Where a detail is not settled yet, we say so instead of guessing.
Last updated: October 2026
- 01
Who this covers
Essentriq provides a lifecycle assurance platform for enterprise IT: it manages identity and access changes, verifies the results and keeps the evidence. This policy covers visitors to essentriq.com, people who create or join a workspace, and the people whose records a workspace holds.
For workspace data (identity records, requests, approvals, audit events) your organisation decides what is loaded and who may see it. Essentriq processes that data on your organisation's instructions. For your own account and for this website, Essentriq decides how data is used.
- 02
What we collect
- Account data: your name, work email, password hash or single sign-on identifier, and the workspace you belong to.
- Workspace data: what your administrators load or sync: people and their attributes from your HR system or directory, groups and applications, access requests, approvals, tasks, notes and the resulting audit trail.
- Billing data: plan, seat counts and payment status. Card details are entered on Stripe's hosted pages and never reach our servers.
- Technical data: a session cookie, a CSRF token, server logs with IP address and user agent, and browser preferences stored locally on your device (see the Cookie Policy).
- Assist prompts: when you use an Assist feature, the current record and your typed request are sent to the model for that single response. See AI and your data.
- 03
How we use it
To run the service: sign you in, show you the records your role allows, apply and verify access changes, keep the audit trail, and send transactional emails such as invitations, approvals and alerts.
To bill your organisation, to keep the service secure (rate limits, sign-in protection), and to support you when you ask.
We do not sell personal data. We do not run advertising. We do not use customer data to train machine-learning models.
- 04
Where it is processed
Essentriq is hosted on managed cloud infrastructure in a United States region. Database, file storage and backups live in that region. Requests to the language model used by Assist are sent to our AI model provider and processed in the United States.
Not yet published: Regional hosting outside the United States is not offered yet. If your organisation needs it, tell us before you load production data.
- 05
Subprocessors
These are the third parties that touch data on our behalf today:
- Cloud hosting and AI provider (United States): application hosting, database, file storage, transactional email and the language-model API behind Assist.
- Stripe (United States): subscription billing and payment processing.
- Microsoft and Google: single sign-on, only when your workspace administrator connects them.
- Public RFC 3161 timestamp authority: receives a hash of each sealed audit segment, never the content.
Connectors you configure yourself (for example your HR system, directory or service desk) are your own systems, not our subprocessors.
- 06
Retention and deletion
Each workspace sets its own retention window for closed cases and audit history. Records past that window are removed by a scheduled cleanup. If no window is set, records are kept while the workspace exists.
Every workspace has its own encryption key. When a workspace is deleted, that key is destroyed first, which makes the encrypted data unreadable even in backups. Session and log data are kept for a short operational period and then dropped.
- 07
Your rights
You can see and correct your own profile in your account settings. For records your organisation holds about you, contact your workspace administrator, who can act on them inside the product with a full audit trail.
Depending on where you live you may also have rights to access, correct, delete or export personal data, or to object to processing. We will support your organisation in meeting those requests.
- 08
Data processing agreement
Not yet published: A standard data processing agreement is being prepared. Until it is published, the terms in this policy and in the Terms of Service apply.
- 09
Changes and contact
If this policy changes in a way that matters, we will update the date at the top and tell workspace administrators by email.
Questions about privacy or security go to [email protected] or through the contact page.