What Cenovel holds
- Equipment, places and network records: devices, serials, closets, ports, outages, work, funding and disposal records, and what each device reported.
- Staff accounts: names, work email addresses, directory identifiers, and sign-in and audit records.
- Building and closet contacts: a name, work email, phone and title, and who holds a closet’s keys.
- From cloud controllers: client counts, never the identities of connected clients.
- For school districts: one student-related number, an enrollment count per site, which the E-Rate Category 2 budget needs. See No student data.
Notes and descriptions are free text and hold whatever is typed into them. Keep personal information about anyone other than staff out of them.
What it never stores
- Directory passwords and Microsoft passwords: they are checked by the directory or by Microsoft and never stored or logged.
- API tokens in clear text: only a hash is kept, and a token is shown once.
- Session tokens in clear text: the server stores only their hash.
Where it lives
Everything Cenovel holds stays on your own appliance, inside your network. It sends no telemetry, never checks for updates and never contacts Cenovel the company, so nothing it holds reaches us. Support works from what you choose to send, and the support bundle masks secrets and holds no database content.
How it is protected
- Stored secrets (device credentials, controller tokens, mail and webhook secrets, authenticator secrets) are sealed with AES-256-GCM under a settings key that never leaves the appliance and can be rotated.
- Backups are encrypted file by file with AES-256-GCM under the backup keyring. Without the keyring a set can’t be read.
- Disks: for encryption of the disks themselves, use vSphere VM encryption.
- Changes are recorded with who, when, from which address, and the values before and after, in a hash-chained audit log.
The detail is on Security architecture.
How long it is kept
| Data | Kept for | Set in |
|---|---|---|
| Deleted records, restorable | 30 days | Recently deleted, on Inventory (1 to 365 days) |
| Delivered notification events | 30 days | Settings (1 to 3,650 days) |
| IP address and browser on imported history | 90 days | Settings (1 to 3,650 days) |
| Backup sets on the appliance | 7 daily, 4 weekly | The appliance’s backup settings |
| Funding, E-Rate, disposal, replacement and RMA history | Never removed for good |
Erasing a person
Erasing a person removes their name, email address and directory handle everywhere and ends their sessions, in one change. It takes two different Administrator EX accounts: one asks, another approves. What they did stays in the history, attributed to a random id.
Questionnaires and agreements
We answer security questionnaires, and we sign district data privacy agreements. Ask on the first call, or write to [email protected].
See also: Security architecture · No student data · Website privacy