Skip to content
Aurykle
Back to Aurykle

Privacy and data governance

Privacy policy

This policy explains the information Aurykle handles, why it is needed, the service providers involved, and how to request access, correction, or deletion.

Last updated 31 August 2026

The short version

Aurykle is a read-only identity-configuration observability service for Auth0 and Amazon Cognito, operated by BugFall. We collect the minimum account, configuration, operational, and support information needed to run the service. We do not sell personal information or use connected-provider configuration for advertising.

Who this policy covers

This policy applies to visitors to aurykle.com, people who request or use the Aurykle beta, workspace members, and people who contact us for support or security reporting. Aurykle is designed for organisations, not for children.

Information we collect and how we collect it

Account information
Auth0 supplies the subject identifier, verified email address, and profile name used to authenticate you. We also store your workspace membership and role.
Connected-tenant information
An authorised workspace administrator supplies either an Auth0 tenant domain and dedicated machine-to-machine credentials, or an AWS account, region, read-only role ARN, and external ID for Amazon Cognito. Credentials and external IDs are encrypted in platform-managed Vault storage. Product tables contain only an opaque secret reference.
Observed configuration
Aurykle reads supported Auth0 or Amazon Cognito configuration, removes secret-bearing and unsupported fields, and stores canonical snapshots, field-level changes, findings, and collection status. Configuration can include business names, identifiers, callback URLs, or other information entered by the customer.
Operations and audit information
We record bounded audit events, collection outcomes, notification delivery status, security-relevant administrative actions, and service diagnostics. We design logs not to contain credentials, access tokens, raw event payloads, or customer configuration values.
Analytics information
If you consent, privacy-limited analytics record page paths with dynamic identifiers removed, static feature/action labels, outcomes, and Web Vitals. Advertising storage and personalisation remain disabled. We do not send emails, authentication subjects, workspace or tenant names, resource identifiers, secrets, or configuration values to analytics. You can change or withdraw your choice on the Analytics settings page.
Communications
We collect the contact details and content you choose to provide when requesting beta access, support, privacy assistance, or reporting a security concern.

Why we use information

  • Authenticate users and enforce workspace and tenant isolation.
  • Connect, observe, compare, and report supported identity-provider configuration.
  • Queue collections, deliver requested notifications, and show service health.
  • Secure, troubleshoot, audit, and improve the beta.
  • Respond to support, privacy, legal, and security requests.
  • Meet legal obligations and protect users, Aurykle, and third parties.

Service providers and disclosure

We disclose information only as needed to operate the service, follow your instructions, comply with law, or protect legitimate rights and safety. Current infrastructure and service providers include:

  • Auth0 for product authentication and the customer-authorised Management API connection.
  • AWS for application hosting, operational logging, alarms, encrypted secrets, and customer-authorised Amazon Cognito configuration access.
  • Supabase for managed PostgreSQL and Vault-backed secret storage.
  • Cloudflare for DNS, TLS, traffic proxying, and abuse protection.
  • Google Tag Manager and configured analytics services only when analytics consent is granted.

We do not sell personal information. We may disclose information to professional advisers, regulators, courts, law enforcement, or a successor to the business where legally permitted and reasonably necessary.

Overseas processing

Some providers operate globally and may process support, account, telemetry, or service data outside Australia, including in the United States and other locations where they or their subprocessors operate. Production data regions are selected separately from provider support and control-plane locations. Contact us for the current provider and region information relevant to your workspace.

Retention and deletion

  • Account, membership, tenant, snapshot, change, finding, run, and audit records are retained while needed to operate the workspace and preserve its requested evidence history.
  • Rotating a tenant credential deletes the superseded Vault secret. Disconnecting removes the active credential and stops collection.
  • Permanent tenant deletion removes the active Vault credential and cascades through that tenant's snapshots, resources, changes, findings, collection runs, notification deliveries, and tenant-scoped audit records. Notifications already delivered to an external destination cannot be recalled.
  • Production service logs are configured for 90-day retention. Security or legal holds may require a longer period.
  • Encrypted backups and provider replicas may retain residual copies until they are overwritten under the provider's backup lifecycle. They remain isolated and are used only for recovery or legal obligations.
  • Consented analytics data follows the retention settings of the configured analytics property. Withdrawing consent stops future analytics storage in your browser but does not rewrite prior aggregated reports.

You can request workspace, tenant, or account deletion through the product where available or by contacting us.

Access, correction, and complaints

To request access to or correction of your personal information, raise a privacy complaint, withdraw consent, or ask about deletion, email jack@bugfall.com. Include enough information to identify your account, but never send passwords, client secrets, access tokens, or raw tenant exports.

We will acknowledge and investigate privacy complaints and explain the outcome. If you are not satisfied, you may be able to contact the Office of the Australian Information Commissioner or another applicable regulator.

Security and data incidents

Aurykle uses read-only provider access, encryption, workspace authorisation, tenant-scoped data access, bounded logging, and complete-snapshot rules. No system is risk-free. If we identify a material data incident, we will contain and assess it, preserve appropriate evidence, and make legally required notifications. Security concerns can be reported through the support and security channel.

Changes to this policy

We may update this policy as the beta, providers, or legal requirements change. Material changes will be identified by a new last-updated date and, where appropriate, communicated through the service or account email. This version took effect on 31 August 2026.