Security & data
How Seqlense GDPR handles access and data - SSO-delegated authentication, opaque sessions, and per-organization data scoping at every layer.
Authentication is delegated to Seqlense SSO. Sessions are opaque, HttpOnly cookies. Data is scoped per organization at every layer.
Access
- Single sign-on via
auth.seqlense.com— no separate password for GDPR. - Users only ever see their own organization's sites, vendors and scans.
- Dashboard access is gated by an active GDPR subscription.
Machine-to-machine calls use an API key instead of a session. A key belongs to an
organization, not a person, so it keeps working when whoever created it leaves.
It can only reach its own organization's data, and it cannot create other keys.
Managing keys requires the developer capability (dev) on your organization,
granted by a platform admin.
Data
- Control-plane data (accounts, sites, vendor registers) lives in a managed relational database.
- Scan data (network requests, third-party hits) lives in a dedicated analytics store, partitioned by month.
- Hosted in Europe, operated in-house.
A cookie's value is never read or stored — a value is often a session token, the kind of personal data this tool must not copy. Only cookie names and attributes are classified.
Reporting a vulnerability
Please write to [email protected].