Privacy Policy
This policy covers the SIEM Dashboard for Wazuh iPhone app (“the app”) and this website. In short: the app has no account, no analytics and no tracking, and we receive none of your data. This website sets no cookies and uses no analytics.
Controller
Alex FitterlingWöhrder Kreuzgasse 8
90489 Nürnberg
Germany
Email: info@sp33c.tech
The app
No data to us
The app has no account and contains no analytics, advertising or tracking code. It sends no data to us, and we run no server for it.
Connections to your own servers
The app connects only to the Wazuh deployments you set up: the Wazuh indexer, to read alerts and agent status; if you set them up, the companion service, for push and SOAR runs, and the Wazuh manager on port 1514, for device posture reporting. These connections go directly from your iPhone to your servers, usually through a VPN you run. What the app shows — alerts, agent names, IP addresses and log lines from your systems — comes from your server and stays between it and your phone. You, or the organisation that runs the Wazuh deployment, are responsible for that data; we have no access to it.
Stored on your iPhone
For each deployment the app stores its name, URLs and TLS settings, including a pinned certificate if you choose one. Usernames and passwords are kept in the iOS Keychain, restricted to this device: they are not synced through iCloud and are sent only to your own server when the app signs in. Recently loaded alerts may be cached on the device so the app opens quickly, and muted rules are stored locally. You can delete a deployment in the app at any time. iOS may keep Keychain entries after an app is deleted, so remove your deployments in the app first if you want the credentials gone.
Push notifications (optional, companion service)
If you run the optional companion service and turn on push notifications, iOS asks for your permission and the app registers your iPhone's push token with your companion service. The companion then sends notifications for critical alerts and SOAR playbook runs through the Apple Push Notification service (APNs). The notification content, such as the alert description, severity and agent name, passes through Apple's servers to reach your phone. Apple processes it under its own privacy policy. You can turn push off in the app or in the iOS Settings.
Device posture reporting (optional)
If you turn this on, the app sends information about your iPhone to the Wazuh manager you configure, using the Wazuh agent protocol: device model, iOS version and build, app version, passcode and biometry status, signs of a jailbreak, whether a debugger is attached, VPN, proxy and network status, screen recording status, language and time zone, and an identifier that Apple generates for this app on this device. It goes only to your Wazuh manager, never to us. Turning the feature off stops the reporting.
Permissions
The app may ask for local network access (to reach a server on your local network), for the camera (only if you scan a setup QR code; images are neither stored nor sent) and for notifications (only if you turn on push). You can change each permission in the iOS Settings.
Crash reports and TestFlight
If you have allowed “Share with App Developers” in the iOS Settings, Apple may share crash reports and diagnostic data with us. If you join the TestFlight beta, Apple shares the name and email address used for your invitation with us, along with any feedback, screenshots and crash reports you choose to send. We use this information only to fix bugs and improve the app. Apple's retention rules apply in App Store Connect.
No tracking
The app does not track you, does not use the advertising identifier and does not share data with data brokers or advertisers.
This website
Hosting and server logs
This website runs on Amazon Web Services (AWS) in the EU (Frankfurt, eu-central-1) and is delivered through the Amazon CloudFront content delivery network, which may serve it from a location near you. When you visit, your browser sends technical data such as your IP address, the date and time, the page requested and your browser identifier. This data is processed to deliver the site securely and reliably; error messages of the site's server are logged and deleted after one month. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working website). AWS acts as our processor under a data processing agreement.
Security monitoring
To protect our systems against attacks and misuse, we analyse server, firewall and application logs (including IP address, time, requested address, browser identifier and error messages) in a security monitoring system. It runs on servers of Hetzner Online GmbH in Germany. The legal basis is our legitimate interest in IT security (Art. 6(1)(f) GDPR, Recital 49). The data is deleted after 90 days unless it is needed to investigate a security incident.
No cookies, no analytics
This website sets no cookies and stores nothing in your browser. It uses no analytics, advertising, tracking pixels, social-media plugins, or externally loaded fonts or scripts. The language is taken from your browser's language setting; if you pick one yourself, the choice is kept in the address (?lang=) and nowhere else.
Contact by email
If you email us, we process your email address and your message to answer you. Legal basis: Art. 6(1)(b) and (f) GDPR. We keep the message only as long as needed to handle your request and to meet legal retention obligations.
Recipients
AWS (hosting) and Hetzner Online GmbH (security monitoring) process data on our behalf, as described above. We do not sell your data or share it with third parties for their own purposes.
Your rights
Under the GDPR you have the right to:
- access your personal data (Art. 15)
- rectification of inaccurate data (Art. 16)
- erasure (Art. 17)
- restriction of processing (Art. 18)
- data portability (Art. 20)
- object to processing based on legitimate interests (Art. 21)
To exercise any of these rights, email info@sp33c.tech.
As the app sends us no data, we usually hold none about you beyond the messages you send us and the server and security logs of this website.
Right to complain
You also have the right to lodge a complaint with a data protection supervisory authority, for example the Bavarian State Office for Data Protection Supervision (BayLDA).
Changes
We update this policy when the app or this website changes. The date at the top shows the latest version.