Legal
Privacy policy
What we collect, why, and what you can ask us to do with it.
Who we are
AkraID is operated by Neftali Zarazua, doing business as AkraID, a sole proprietorship based in Omaha, Nebraska ("AkraID", "we", "us"). This policy covers the website at akraid.com and the AkraID service at app.akraid.com. Questions go to hello@akraid.com.
The short version
- The website uses no cookies, analytics, advertising or tracking.
- In the AkraID service, the data about your employees belongs to your company. We process it only to run your access reviews.
- We don't sell personal information, share it for advertising, or use it to train AI models.
1. The website
The website doesn't set cookies or run analytics or third-party scripts. Our hosting provider, Cloudflare, handles requests to the site and may keep short-lived technical logs (such as IP addresses) to deliver the site and protect it from abuse.
The live demo at akraid.com/demo runs entirely in your browser with made-up data. Nothing you do in it is sent to us or stored after you close the page.
If you email us, for example to book a demo, we receive your name, email address and whatever you choose to write. We use it to reply, and keep it in our email system (Microsoft 365) for as long as it's useful for that conversation or our relationship with your company.
2. The AkraID service
Data your company connects
When a company ("customer") connects its Okta organization, AkraID reads and stores, for the people in that organization: name, work email, login, job title, department, manager, account status, the apps each person can use and their role in each, and when they last signed in to each app according to Okta's sign-in log. Customers also create review decisions, reasons and notes in AkraID.
For this data, the customer decides what's collected and why, and we act on its instructions. In privacy-law terms, the customer is the controller (or "business") and AkraID is its processor (or "service provider"). If your employer uses AkraID and you have a question about your data, please contact your employer first; we'll help them answer it.
People who use AkraID
When you sign in, we receive your name, email address and an identifier from your company's Okta. We keep a record of what you do in AkraID in a tamper-evident audit trail, because that record is what your company's auditors rely on. We use one strictly necessary cookie to keep you signed in. Our hosting provider keeps short-lived request logs that may include IP addresses.
Managers who reply by link
If a reviewer asks you about someone's access, you can reply through a link, without an account. We store your reply and when you sent it.
What we never collect
Passwords, MFA factors, the contents of any app, or payment card numbers.
3. How we use information
- To provide, secure and support the service, and to fix problems with it.
- To reply to you and to send notices about your account or this policy.
- To bill customers.
- To meet legal obligations.
We don't use customer data for any other purpose, and we don't combine it across customers.
4. Who we share it with
We use a small number of providers to run AkraID. They may process information only to provide their service to us.
| Provider | Purpose | Location |
|---|---|---|
| Render | Hosting the AkraID app and database | United States |
| Cloudflare | DNS and website hosting | Global network |
| Microsoft 365 | United States |
We'll update this list before adding a provider that handles customer data. We may also disclose information if the law requires it, to protect the rights and safety of our users or the public, or as part of a sale or reorganization of the business, in which case this policy would continue to apply to the information transferred.
5. How long we keep it
- Customer data is kept while the customer's account is active. When an account ends, the customer has 30 days to export its evidence packs and audit trail, after which we delete its data. Copies in backups are removed as those backups expire.
- Email is kept as long as it's useful for the conversation or our relationship with your company.
6. Security
We protect information with encryption in transit and at rest, access controls, and a tamper-evident audit trail. Our security page describes the measures in detail. No system is perfectly secure; if we learn of a breach affecting your information, we'll notify affected customers without undue delay and as the law requires.
7. Your choices and rights
Depending on where you live, you may have the right to ask for access to, correction of, deletion of, or a copy of your personal information, and to object to or limit certain uses. To make a request, email hello@akraid.com. If the information is customer data, we'll pass the request to the customer and help it respond. We won't treat you differently for exercising your rights.
8. Where it's processed
AkraID is based in the United States, and information is processed and stored there. If you're outside the US, your information will be transferred to the US.
9. Children
AkraID is a business service and isn't intended for anyone under 16. We don't knowingly collect information from children.
10. Changes
If we change this policy, we'll update the date at the top. If a change is significant, we'll notify customers by email before it takes effect.
11. Contact
AkraID, Omaha, Nebraska, United States. hello@akraid.com