OCTA

OCTA

Corporate Governance

Privacy Policy

Effective Date: October 5, 2026

OCTA ("we," "our," or "us") adheres to strict protocols regarding data protection and enterprise privacy. This Global Privacy Policy details the collection, processing, and safeguarding of information when your organization utilizes our intelligent enterprise project delivery platform and associated cloud infrastructure (collectively, the "Services").

1. Enterprise Data Collection Architecture

1.1 Direct Information Provision

During the configuration, deployment, and operation of an enterprise workspace, our platform requires specific data points to function effectively:

  • Administrative Identifiers: Authorized personnel contact details, organizational affiliations, billing addresses, and administrative designations.
  • Identity & Access Management (IAM): Single Sign-On (SSO) integration tokens (SAML/OAuth), cryptographic assertions, and context vectors for Multi-Factor Authentication (MFA).
  • Operational Telemetry: Structural project data, team capacity vectors, and automated integration payloads originating from linked engineering systems (e.g., Jira, GitHub, CI/CD pipelines).

1.2 System-Generated Telemetry & Diagnostics

To ensure system integrity, threat prevention, and high performance, we automatically capture specific diagnostic metadata:

  • Security Audit Trails: Originating IP addresses, device compliance states, chronological access logs, and granular API request vectors.
  • Performance Analytics: Aggregate utilization metrics strictly required to optimize our analytical capacity engine and resource allocation.

2. Authorized Data Processing & Utilization

OCTA processes Customer Data exclusively for the execution, maintenance, and security enhancement of the Services. Authorized processing activities include:

  • Deployment and maintenance of strictly isolated, multi-tenant cloud environments.
  • Continuous evaluation of authentication requests via our Zero Trust Authorization Engine.
  • Algorithmic processing of structural workflow data to yield capacity forecasts, bottleneck predictions, and risk assessments specific to your organization.
  • Fulfillment of compliance and auditing obligations, ensuring immutable activity records mapping to SOC 2 Type II and ISO 27001 security standards.

3. Disclosure and Third-Party Sub-Processing

We do not monetize, rent, or sell your enterprise data. Information disclosure is strictly restricted to the following operational necessities:

  • Authorized Sub-Processors: Premier cloud infrastructure partners (e.g., AWS, Google Cloud) operating under strict Data Processing Agreements (DPAs) and confidentiality constraints.
  • Statutory Compliance: Where mandated by binding legal order or regulatory requirement, subject to prior notification to your organization where legally permissible.
  • Corporate Restructuring: During mergers, acquisitions, or asset sales, wherein data transfers remain subject to equivalent protective covenants.

4. Cryptographic Security Standards

All Customer Data processed by OCTA is subjected to robust cryptographic standards. Data at rest is encrypted utilizing AES-256 protocols. Transit encryption relies on strict TLS 1.3. Your enterprise workspace is logically partitioned, governed by dedicated Key Management Service (KMS) integrations. Unauthorized access by internal personnel is prevented via stringent, time-bound Access Control Lists (ACLs) and regular penetration testing.

5. Global Compliance Frameworks (GDPR & CCPA)

Dependent on jurisdictional applicability (including the European Union and California), individuals may assert specific rights concerning their personal data:

  • Right of Access: The right to request a comprehensive record of processed data.
  • Right to Erasure: The right to mandate the erasure of specific personal identifiers ("Right to be Forgotten").
  • Right to Rectification: The right to request the correction of demonstrable inaccuracies.
  • Right to Restriction: The right to limit specific sub-processing operations.

Data Subject Access Requests (DSARs) must be directed through your organization's designated OCTA Administrator for initial verification before processing by our systems.

6. Data Lifecycle & Retention Management

Information is retained strictly for the duration of an active enterprise SaaS engagement or as necessitated by statutory requirements. Upon contract conclusion or explicit termination, all associated data environments and unique cryptographic keys undergo automated destruction protocols within 30 days, rendering data recovery permanently impossible.

7. Policy Amendments

We reserve the right to revise this Privacy Policy to accommodate regulatory shifts, compliance mandates, or technical advancements. Designated administrative contacts will receive formal digital notification of any material modifications prior to implementation.

8. Privacy Office Contact

For inquiries regarding data protection protocols, compliance requests, or Data Processing Agreement (DPA) execution, please contact our global Data Protection Officer (DPO) at:

Email: info@octaverse.live