Privacy policy
What we store, why, who else receives it, and how long it’s kept.
Effective October 31, 2026
Who this covers
This policy covers the hosted IdRa service at idra.team and its organization addresses, the site at idra.zone and the documentation at docs.idra.zone. They are run by IdRa Corp. (US) (“we”). Contact: privacy@idra.zone.
An organization that signs up decides who gets an account and what is stored about them. If your employer or a partner gave you an account, it decides how your data is used, so ask it first. Anyone running IdRa on their own servers is responsible for that copy, and this policy doesn’t cover it.
What we store
Each organization has its own database. Signup and operator records are kept separately.
- Signup
- Organization name and address, the admin’s name and email, and a hash of the emailed link.
- Account
- Name, email, optional image, status, and the profile attributes the organization sets.
- Credentials
- A hashed password, authenticator secrets and passkey public keys.
- Sessions
- IP address and browser user agent.
- Devices
- Name, platform, OS version, browser, user agent, a serial number if a device manager supplies it, and last IP address.
- Audit log
- Who did what to what, the outcome, IP address, user agent, session ID and event details. Country, city and network are added only when a location source is connected, and idra.team has none connected today.
- Risk
- Signals such as a new device or impossible travel, and a current risk level.
- Access requests
- The group, the reason you wrote, the decision and the approver’s note.
- Imports
- Uploaded people CSV rows while an import runs, and its error list.
- Inventories
- Records copied from a device manager or software vendor the organization connects.
- Secrets
- Vault secrets and integration credentials, stored encrypted.
These sites contain no analytics service. We count signup steps as totals, with no personal data in the counts.
Why we use it
- To sign people in, enforce the rules their organization sets, and connect them to apps.
- To secure the service, with rate limits, risk detection and an audit trail.
- To send the email the service depends on.
- To operate the service, using signup totals and error diagnosis.
Email is sent through Resend as no-reply@sec.idra.team. Resend receives the recipient, subject and full message. Messages can hold one-time codes, links, names and email addresses. New sign-in notices, on by default, also hold the device, the IP address and any known location.
Logs
Server warnings and errors are written with the time, level, message, request ID, method, route pattern, an opaque organization ID and error details. The text is first scrubbed of email addresses, tokens, credentials, query strings and IP addresses. Scrubbing works by pattern, so it can miss something, such as a name in an error message.
Failed background jobs keep their raw error message in the organization’s own database, and that message can quote values from a failed query. Our hosting provider may keep its own logs.
Cookies and browser storage
- Session cookie
- Keeps you signed in. Lasts 12 hours, renewed as you use the service.
- Device cookie
- Recognizes this browser for new-device notices and risk checks. Lasts 400 days.
- Two-factor cookie
- Holds a sign-in between your password and second factor.
- Sidebar cookie
- Remembers whether the console sidebar is open. Lasts 7 days.
- Theme, in local storage
- Remembers light or dark mode until you clear it.
The site at idra.zone and the docs at docs.idra.zone set no cookies.
Who else receives data
- Railway
- Hosts the service, site, docs and databases, in the United States. It holds everything in the service.
- Resend
- Sends email, and receives what the Email section lists.
- Cloudflare
- Answers DNS lookups for our domains. Service traffic doesn’t pass through it.
- Your browser fetches logos for apps added from the catalog from Google’s favicon service, which sees your IP address and the app’s domain.
- Your browser’s push service
- Only if you enroll push on a device. It sees the push endpoint and timing, and our message to it is empty.
Organizations can also connect services of their own, such as identity providers, SMS, device managers, webhooks or log streams. Data sent there follows that organization’s choice and that service’s terms.
How long we keep it
- Audit log and finished jobs
- 90 days by default. The organization can change this. Older entries are purged every 6 hours.
- Unconfirmed signup
- The link lasts 24 hours, and the record is deleted 7 days after that.
- Accounts, devices, risk events and other organization data
- Until they are deleted, or the organization is.
- Operator log of signups and organization changes
- Kept without an automatic time limit. Entries can hold the signup email, and they outlast the organization.
- A deleted organization’s address
- Kept permanently, so nobody can reuse its sign-in address.
- Organization export
- Held encrypted for 24 hours, then deleted. A file already downloaded is the organization’s responsibility.
- Backups
- Point-in-time recovery backups are kept on a rolling basis. Restoring one can bring back data deleted after that point, so we re-apply erasures after a restore.
Your choices and requests
If you have an account in an organization, ask its administrators. A super administrator can export a person’s data as JSON, or erase a person after deactivating them. Erasing deletes the account and removes the person’s name, email, IP address, location and browser from retained audit events, which remain with an opaque ID. It doesn’t reach copies in services the organization connected, email already sent, or organization exports already downloaded.
If you run an organization, a super administrator can download a JSON copy of its data under Settings → Privacy, including people’s profiles and up to 90 days of the audit log. It leaves out passwords and other secrets. To delete the organization, email hello@idra.zone from its admin email. Deletion drops the organization’s database and can’t be undone.
Anyone else, or for data we decide on, email privacy@idra.zone.
Security
Secrets at rest are encrypted with AES-GCM, and sign-in cookies are Secure, HttpOnly and SameSite=Lax. SOC 2 Type I audit in progress.
Where data is processed
The hosted service and its databases run in the United States, and every organization is hosted there.
Changes
We’ll post changes here, and email organization admins before material ones take effect.