InfraDesk

GDPR overview

Implementation is concrete and documented rather than declarative. An Article 13 information notice sits on a dedicated page, and an Article 28 processing agreement — in force since 16 August 2026 and described by the vendor as compliant with that article — is published in full, with a signable PDF available on request. No data protection officer has been appointed, the vendor stating that no Article 37 condition applies; GDPR enquiries go to a dedicated address. The agreement commits to notifying breaches within 24 hours of detection with the Article 33(3) information, to one customer audit per calendar year on fourteen days' notice, and to thirty days' warning before any subprocessor changes, with a right to object and terminate. Transfers outside the EEA are confined to the AI assistant and web push, under standard contractual clauses or the EU-U.S. Data Privacy Framework.

Who owns the data?

The customer keeps ownership. The privacy policy states plainly that everything created inside a workspace — tickets, devices, vault entries — remains the customer's property and that the vendor acts only as a processor. The Article 28 processing agreement confirms it: the customer is the controller, SILERS processes only on documented instruction expressed through the product's configuration and interface. Customers can export a full JSON dump of their workspace on request, and can delete a user, a device or the entire workspace from the panel. When the service ends, customer data is erased within thirty days, or made available for export if asked within that window.

Reuse rights

Customers may reuse everything they put into or generate inside their workspace without asking permission: the vendor claims no licence over it and processes it only to run the service. A full JSON export of the workspace is provided on request, so the data can be moved elsewhere, kept as an archive or fed into another system. Stated purposes are limited to delivering the service, issuing VAT invoices, security and audit, plus marketing of the vendor's own services where consent has been given. Only technical cookies are used — no analytics, no marketing trackers, and no sharing with third parties for advertising. Where the AI assistant is used, the query and the selected workspace context go to Anthropic for the duration of the answer and are not used to train models; the whole AI module can be switched off for the workspace, after which no data leaves the vendor's infrastructure.

Data retention & training

Hosting summary

Customer data is stored in the European Economic Area, and the vendor states that workspace data sits in Poland with backups in Poland and the wider EEA. The hosting provider itself is not named — the subprocessor table lists only 'VPS provider', located in Poland. Encrypted customer backups go to rapidbox (RapidDC) in Poland, with object storage at OVHcloud inside the EEA. Notification and invoice email runs through a Polish SMTP provider, and subscription payments through Paynow, part of mBank, also in Poland. Two subprocessors reach beyond the EEA: Anthropic in the United States, which receives only AI assistant queries under standard contractual clauses and the Data Privacy Framework, and Google Ireland for web push and optional Google Drive backup destinations. Vault entries, database passwords and backup keys are encrypted at rest with AES-256-GCM under a master key held outside the database, and customer backups are encrypted before leaving the premises. The public site itself resolves to an address in Olsztyn, Poland, consistent with the stated arrangement.