How we protect your inventory · and what we deliberately don't do.
CenseCloud stays outside your traffic path and works from metadata alone. Every boundary that keeps it that way is written out below.
Five boundaries we don't cross.
Each boundary follows from how the product is built, so it holds regardless of what a policy document says later.
No proxy in your traffic path
Traffic to your business applications goes straight from the device to the application. CenseCloud is never a hop in that path, so it adds no latency and introduces no failure point.
No MITM, no inline decryption
TLS sessions run end to end between the device and the application. CenseCloud terminates no connection on that path, so there is no position from which user traffic could be read.
No agents on prod servers
The endpoint agent runs on user devices · laptops and workstations. Never on production servers, databases or domain controllers. Your critical infrastructure stays untouched.
Endpoint-only signals
Inventory is built from the user's own endpoint and browser · what they install, what they open, what they grant. What leaves the device is the event record; the files and messages themselves stay where they are.
Action and destination signals
We capture the action and the target's risk score. Message bodies and file contents stay outside the collector.
We collect the action and the target. We don't read the content.
B2B SaaS governance often blurs into surveillance. The line we draw is concrete: we observe what was done and where it was sent, never what was inside it.
What the inventory is built from.
- User action · App opened, paste attempt blocked, file-share blocked, page visited · the fact of the action, with timestamp.
- Target risk score · The destination SaaS or AI tool's classification: AI-category, personal-account, foreign jurisdiction, no-SSO. Score only · not the page body.
- Identity attributes · AD username, OU, group membership, lastLogon (MAX across DCs). Pulled from your directory; never enriched with external profiles.
- OAuth grants · Third-party application consents in your Entra/Workspace tenant · app name, scopes, granting user, timestamp.
- Endpoint inventory · Installed applications, browser extensions, IDE extensions. Names and versions · not the data inside any of them.
- Licence and spend · Where you connect finance integrations: subscription line, seat count, renewal cycle. We see the contract, not the content of usage.
Data we stay away from on purpose.
- Message and file content · Email bodies, chat messages, document contents and pasted text are never read. The action is recorded; what it carried stays on the device.
- Keystrokes / clicks · No keylogging, no click-tracking. The endpoint agent observes process and event metadata, not user input.
- Screen contents · No screen capture, no screenshot streams. Even when policy fires (block, coach), we don't transmit what was on screen.
- Personal identifiers · We don't extract national IDs, payment cards, phone numbers or other PII fragments from traffic or content. We don't need them.
- Database rows · We don't connect to your application databases. CenseCloud reads its own inventory, not your business records.
- Browsing history at large · Outside known SaaS and AI categories, browsing isn't recorded. Visiting a news site is invisible to us.
We help you prove compliance · and we're exact about what we hold ourselves.
CenseRisk maps every risk to the frameworks your auditors actually use · a product capability, listed separately from the certifications the company itself holds.
CenseCloud holds no third-party security certification at this time. The frameworks listed below describe what our product reports against, so your team can prepare evidence · not certifications carried by the company itself.
KVKK
ReportingDedicated risk layer in the engine. RoPA-grade export, special-category data flagging, cross-border transfer view, DSR support.
GDPR
ReportingArticle 30 records of processing, a lawful basis review, third-country transfer markers · all from the same inventory.
ISO 27001
ReportingAsset inventory, supplier security, access control and access review · the Annex A control families we map to. Evidence pulled from the live inventory.
NIST CSF 2.0
ReportingMapping to the GOVERN, IDENTIFY and PROTECT functions · asset management, supply chain and access control. Built for the 2.0 framework from the start.
EU AI Act
ReportingRisk tagging on AI applications, governance ladder (sanctioned · monitored · conditional · blocked), evidence trail per AI inventory item.
Per-firm separation by construction.
Every firm is its own tenant inside CenseCloud. The firm identifier is part of the query itself, so there is no setting that could let one firm see another's inventory.
Per-firm tenant model
Each customer gets a dedicated tenant context. Every query, every API call carries the firm identifier and is filtered at the data layer.
Reviewed isolation
Tenant separation is covered by our internal end-to-end audits; the security questionnaire response spells out what they cover.
Role-based access
Super admin / admin / viewer roles per tenant. Module-level scoping for read versus action. Sensitive operations gated to the admin role.
Audit-immutable trail
Policy changes, access reviews and closure events are written to an audit log that the dashboard cannot retroactively edit.
Vendors who process data on our behalf.
Under KVKK and GDPR, we disclose the third parties that touch customer data when CenseCloud operates. The list below is current. We notify customers before adding a sub-processor that handles customer data.
For DPA terms, talk to us via the contact link below.
Found something? Tell us first.
If you think you've found a vulnerability in CenseCloud, write to us before publishing. We commit to a defined response timeline and to crediting you in the fix where appropriate. Coordinated disclosure makes the product safer for everyone.
- Acknowledgement within 2 business days of your report.
- Triage and severity assessment within 7 business days.
- Credit in the changelog for confirmed reports, where you want it.
Want the DPA, the sub-processor list or a security review?
We send our DPA, current sub-processor list, and security questionnaire response by email on request. No portal, no friction.