IDemGuard is an identity and access management service. For us, protecting personal data is not a regulatory burden — it is our core business. This policy describes, in plain language, what data we process, why, for how long, where it is hosted and what your rights are — in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act. This English translation is provided for convenience only; in the event of any discrepancy, the French version prevails.
1. Data controller
CyberDefGeek, a French SARL with registered office in Boissy-Saint-Léger, registered with the Créteil Trade Register under number 925 010 803 (hereinafter “IDemGuard” or “we”).
Personal data contact / DPO: Jasmin Djipanov — contact@idemguard.com
2. Two roles, two scopes
Depending on the situation, IDemGuard acts in two different capacities, which determines who you should contact and the extent of our obligations:
- Data controller for the data we collect directly: visitors of idemguard.com, people who contact us, users of the demonstration, and our customers' business and administrative contacts (section 3).
- Processor, within the meaning of Article 28 of the GDPR, for the data of end users (employees, agents, customers, citizens) that our customers manage in the IDemGuard service. In that case, our customer is the data controller and we act exclusively on their instructions (section 4).
3. Data processed on our own behalf
| Situation | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| You contact us (email, demo request) | First and last name, email address, company, role, content of your message | Answering your request, organizing a demo, sales follow-up | Legitimate interest (responding to an inquiry, B2B prospecting) | 3 years after the last exchange |
| You use the demonstration (demo.idemguard.com) | Name, email address, login credentials, usage logs | Providing the demonstration environment, security | Performance of pre-contractual measures | 90 days after the last login |
| You are a customer (administrative contact, billing) | Identity and contact details of contact persons, billing data, contractual and support history | Contract performance, billing, support, dispute management | Contract performance; legal obligations (accounting and tax) | Duration of the contract, then 10 years for accounting records |
| You browse the website | IP address, browser type, pages visited, timestamps (server logs) | Security, incident detection, the host's legal obligations | Legitimate interest; legal obligation (LCEN) | 12 months |
We carry out no profiling, no automated decision-making with legal effects, and we neither sell nor rent your data to third parties. We use no third-party analytics tool on this site.
4. Data processed for our customers
When an organization uses IDemGuard to manage its users' access, we process on its behalf:
- Identity data: first and last name, email address, username, and possibly photo, phone number, department, role or any attribute synchronized from the customer's directory;
- Authentication data: password hashes (never in clear text), two-factor authentication factors, sessions, tokens;
- Authorization data: groups, roles, authorized applications;
- Authentication and administration logs: timestamps, IP address, device, outcome of the attempt, administrator actions;
- Where applicable, the attributes transmitted by FranceConnect, ProConnect or France Identité, strictly limited to the scopes requested by the customer.
This processing is governed by a data processing agreement (DPA) compliant with Article 28 of the GDPR, annexed to the Terms of Service. We access data only on the customer's documented instructions, to provide, secure and maintain the service. At the end of the contract, data is returned to the customer in a standard format and then deleted within 30 days, except for logs whose retention is required by law.
If you are an end user of a service protected by IDemGuard (for instance an employee of a customer company or a user of an online service), please address requests about your data to that organization, which is the controller. We assist it in handling your request and, if you write to us directly, we forward your request to it without delay.
5. Hosting and location
All data — website, demonstration and service — is hosted in France by OVH SAS (2 rue Kellermann, 59100 Roubaix), in the Gravelines and Strasbourg data centers, with replication between the two sites. Backups are encrypted and kept in the same data centers.
No data is transferred outside the European Union. We use no subcontractor subject to extraterritorial legislation (such as the US Cloud Act) for hosting, processing or backing up service data.
6. Recipients and processors
Your data is accessible, within the limits of their duties, to the IDemGuard teams in charge of sales, support and technical operations. We use the following processors, all established in the European Union:
| Processor | Service provided | Location |
|---|---|---|
| OVH SAS | Hosting, infrastructure, backups | France (Gravelines, Strasbourg) |
| Keobiz | Billing, accounting | France (Paris) |
| OVH SAS | Email delivery (notifications, password resets) | France (Gravelines, Strasbourg) |
Your data may also be disclosed to administrative or judicial authorities where required by law, strictly within the scope of their powers.
7. Security
We implement technical and organizational measures appropriate to the sensitivity of identity data, including:
- encryption of all communications with TLS 1.3 and encryption of data at rest;
- passwords stored as salted hashes (hashing algorithms with configurable cost), never in clear text or reversible;
- mandatory two-factor authentication for all administrative access, at our customers as well as within our own teams;
- isolation of customer environments, continuous logging and monitoring, protection against brute-force and credential-stuffing attacks;
- encrypted and tested backups, disaster recovery plan;
- our teams' access limited to the strict minimum, logged and reviewed periodically.
In the event of a data breach likely to result in a risk to your rights and freedoms, we notify the CNIL within 72 hours and inform the affected customers without delay, in accordance with Articles 33 and 34 of the GDPR.
8. Your rights
In accordance with Articles 15 to 22 of the GDPR, you have the following rights over your data: access, rectification, erasure, restriction of processing, portability, objection (in particular to prospecting), as well as the right to set directives regarding your data after your death.
To exercise these rights, write to us at contact@idemguard.com or by post to the address given in section 1, specifying the subject of your request. We may ask for proof of identity in case of reasonable doubt. We respond within one month, extendable by two months for complex requests.
If, after contacting us, you believe your rights are not being respected, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.
9. Cookies and trackers
Showcase website (idemguard.com)
The site sets no cookies for analytics, advertising or social media. No consent banner is therefore required.
The site's fonts and all its resources are hosted on our own servers: no resource is loaded from a third-party service, and your IP address is not transmitted to any other party during your visit.
Demonstration and IDemGuard service
These services use only strictly necessary technical cookies: maintaining your authenticated session, protection against request forgery (CSRF) and remembering your interface preferences. They are exempt from consent (Article 82 of the French Data Protection Act, CNIL guidelines) and expire when the session is closed or at the latest after 30 minutes.
10. Changes
We may update this policy to reflect legal, technical or organizational changes. The date of the last update appears at the top of the page. In the event of a substantial change, customers are informed by email at least 30 days before it takes effect.
11. Contact
For any question about this policy or your data: contact@idemguard.com.