Privacy Policy & Data Architecture
We operate with strict data minimization principles. Learn how we safeguard your email and activation credentials.
1. Zero Plaintext Secret Storage
SecureCDK never stores raw activation keys in plaintext. All activation codes are encrypted at rest using AES-256-GCM authenticated cipher blocks. Rapid lookup and verification are performed using HMAC-SHA256 blind cryptographic hashes keyed with an isolated hardware-secured pepper. Complete activation keys are never written to application logs, exceptions, or telemetry streams.
2. Recipient Email Protection & Masking
Your destination email address is collected strictly for OTP delivery and third-party workspace invitation dispatch. Public-facing endpoints, status queries, and shared links always display your email in masked format (for example, c***r@example.com). Your email is never sold, shared with marketing networks, or used for unsolicited communication.
3. Ephemeral Email Verification Records
One-Time Password (OTP) verification records are hashed and automatically expire after 10 minutes. Verification session tokens are cryptographically signed with HMAC-SHA256 and expire after 30 minutes. Once redemption is confirmed, verification state transitions to immutable audit logs.
4. Unguessable Redemption Tracking
Status tracking URLs utilize 128-bit CSPRNG hex tokens. Only an individual in possession of the unique token link can access the fulfillment status. Guessing or sequential enumeration attacks are mathematically impossible.
5. Data Retention & Right to Purge
Customers may request deletion of non-essential redemption and audit logs after entitlement fulfillment is finalized by contacting our Privacy Officer.