About · License · System Info · Privacy · Security · Changelog · README · Administrator Guide · User Guide

Data Processing

CSAF is designed as a self-hosted application. All data is stored locally on the server where the application is deployed.

Data Collected

• CSAF documents — stored in the embedded redb database
• User accounts — login credentials (hashed) stored in SQLite
• Audit logs — timestamps and actions for document operations
• Session data — temporary session tokens for authentication

No External Communication

The application does not send data to external services, analytics platforms, or third-party APIs. All processing occurs locally.

Data Retention

Data is retained until explicitly deleted by the user or administrator. Audit logs are stored indefinitely for compliance purposes.

GDPR Compliance

As a self-hosted tool, GDPR compliance responsibility lies with the deploying organisation. The application supports data export and deletion to facilitate compliance.