Privacy Policy
Brikbox Pty Ltd (“we”) runs EverTLS. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). This policy explains what we collect, why, who we share it with, and your choices.
What we collect
- Account details: your name, email address, a hash of your password (never the password itself), your two-factor setup, and the organisations and roles you belong to.
- What you manage in EverTLS: domain names, certificates and certificate requests, validation settings, alert channels (email addresses, Slack/Teams/webhook URLs), monitored endpoints and audit-log entries. DNS provider credentials and private keys we generate are encrypted at rest.
- Agents: the host name, operating system, agent version, public IP address, and the web server sites and certificates found on servers where you install the agent.
- Usage and security data: IP addresses, sign-in times, and server logs, used to secure the Service and investigate problems.
We don’t sell personal information, and we don’t use advertising or analytics trackers. The dashboard uses one essential cookie to keep you signed in.
Why we use it
To provide EverTLS (issue, renew, deliver and monitor certificates), send account and alert emails, secure accounts and the Service (rate limits, network restrictions, audit logs), give support, meet legal obligations, and improve the product. We email you about your account and alerts you set up; any product news would be optional and easy to unsubscribe from.
Who we share it with
We share only what each service needs:
- Certificate authorities such as Let’s Encrypt (USA) receive the domain names on your certificates. Publicly trusted certificates and their domain names are published in public Certificate Transparency logs.
- Hosting: Hetzner Online (Germany) runs the EverTLS servers and database; OVHcloud (Singapore) runs our secondary DNS server and stores encrypted backups.
- Email: BrikSend, our transactional email service, delivers account and alert emails.
- Website: Vercel (USA) hosts evertls.com; Cloudflare (USA) provides DNS for our domains.
- Your own integrations: DNS providers, Slack, Microsoft Teams or webhooks you connect receive what’s needed for the actions you configured.
- Authorities, where the law requires it.
Some of these are outside Australia (Germany, Singapore and the USA). We choose providers with appropriate security and contractual protections.
How long we keep it
Account and organisation data is kept while the account exists. When you delete certificates, agents or credentials they’re removed from the live database straight away and from backups within 30 days. Server logs are kept for up to 90 days; the audit log is kept as long as the organisation exists so its history stays complete.
Security
Encryption in transit and at rest for secrets, hashed passwords, two-factor sign-in, role-based access, optional network restrictions, a tamper-evident audit log, and encrypted off-site backups. No system is perfectly secure; if a breach is likely to cause you serious harm we’ll notify you and the Office of the Australian Information Commissioner as the law requires.
Your choices and rights
You can see and update your details in the dashboard, and ask us for access to, correction of, or deletion of your personal information at privacy@evertls.com. We’ll respond within 30 days. If you’re not satisfied with how we handle a privacy concern, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.
Changes
We’ll post updates here with a new effective date, and email account owners about material changes.
Contact
Brikbox Pty Ltd · privacy@evertls.com