Privacy policy

Last updated 31 October 2026

TBDL ("we") runs AlphaNet. This policy says what we collect when your organization uses it, why, and what you can do about it. Your organization decides which people and devices use AlphaNet; for that data we act on its behalf.

What we collect

Accounts: names and email addresses of your users and administrators, your organization's name, and sign-in details from your identity provider if you connect one.

Devices: each device's name, operating system and version, AlphaNet version, its public keys, the network addresses we see it connect from, when it was online, and the results of its security checks, update runs and (if you turn it on) Wazuh monitoring: settings found, software installed, vulnerabilities, alerts.

Backups: backed-up files are encrypted on the device before they're sent; we store only the encrypted data. Your organization's backup key is kept sealed on our servers so your administrators can restore any device, and every use of it is recorded in your audit log. We don't open your backups unless your administrators ask us to help restore them or the law requires it.

Billing: Stripe handles payments; we receive your subscription status and billing contact, never full card numbers.

What we don't collect: the traffic between your devices. It is encrypted with keys that never leave them, and relays only forward encrypted packets.

Why we use it

To connect your devices, show your administrators their state, run the features they turn on, bill for the service, keep it secure (for example, investigating abuse), and send service emails such as sign-in links. We don't sell personal data or use it for advertising.

Who we share it with

Only the providers that run the service for us, under contracts that protect the data: DigitalOcean (hosting), Stripe (payments) and Resend (email). We disclose data to authorities only when the law requires it.

How long we keep it

As long as your organization uses AlphaNet. When an administrator deletes the organization, its devices, users, settings and backups are deleted; backups follow the retention your administrators set. The audit log, billing records and copies in our system backups are kept for as long as the law or security needs require, then deleted.

Security

Data is encrypted in transit and stored encrypted on our servers; access is limited to the people who run the service.

Your rights

You can ask for a copy of your personal data, its correction or its deletion. Members of an organization should usually ask its administrators first, since they control its data. Write to support@tbdl.app; we answer within 30 days.

Changes

We'll post updates here and tell administrators by email about important ones.