Privacy policy

Data controller

Pennyworth is deployed and administered by your organization. The data controller for personal data is your employer or the entity operating this instance, not the software vendor.

Data collected

To operate, Pennyworth processes:

• Account identity (username, email, role) and origin (local, LDAP, OIDC, SAML)
• Login and activity logs (timestamp, IP address, device)
• Technical inventory reported by collectors — satellites or agents (systems, packages, versions)
• Secrets tied to two-factor authentication (encrypted TOTP key, hashed recovery codes)

Purposes

This data is used exclusively for authentication, access control, action traceability and vulnerability prioritization across your fleet. No data is used for advertising purposes.

Retention

Activity and login logs are kept on a rolling 12-month basis. Inventory data is kept as long as the corresponding system is active, then archived or deleted according to your organization's retention policy.

Your rights

Depending on applicable regulations, you have the right to access, rectify and delete data concerning you. Send your request to the administrator of your Pennyworth instance or to your data protection officer (DPO).

Contact

For any question about this processing, contact the administrator shown in your instance settings.