Privacy policy

Effective date: 15 November 2026

This policy explains how SSOGEN Corporation (“SSOGEN”, “we”, “us”) handles personal data when you:

• visit ssogen.ai or another SSOGEN website (the “Website”);
• use the SSOGEN Authenticator app for iOS or Android (the “App”);
• contact us for sales or support; or
• work for an organization that uses SSOGEN software or an organization hosted by SSOGEN (the “Services”).

SSOGEN Corporation is a Delaware corporation with its headquarters at 8585 N. Stemmons Fwy, Suite 412, Dallas, TX 75247, USA.

The short version

• The Website sets no cookies and runs no analytics or advertising trackers.
• The App sends nothing to SSOGEN. It talks only to your organization’s own SSOGEN server. Its secrets stay on your phone.
• When your organization runs SSOGEN itself, the data stays on its own servers, and SSOGEN cannot see it.
• When your organization is hosted by SSOGEN, we process its data only to provide the service, under our agreement with your organization.
• We do not sell or share personal data for advertising, and we do not use it to train AI models.

1. Who is responsible for your data

• Website, sales and support: SSOGEN is the controller of the personal data described in sections 2 and 3.
• Your organization’s sign-in data: when your employer or another organization (“your organization”) uses SSOGEN to sign you in, that organization decides what data is held about you and why. It is the controller, and its own privacy notice applies. Where SSOGEN hosts the service, SSOGEN acts as a processor (or “service provider”) on your organization’s behalf (section 5).
• The App: the App stores data on your phone and sends it only to your organization’s SSOGEN server. Your organization is the controller of that data (section 4).

If you have a question about the data your organization holds, ask your organization first. If you write to us about it, we will pass the request to your organization when we can tell which one it is.

2. The Website

What we collect. The Website has no forms, no accounts and no tracking.

• Server logs. The Website is hosted on Cloudflare. Like any web host, Cloudflare receives technical data with each request: your IP address, the page requested, the time, your browser’s user agent and the referring page. It uses this data to deliver the site and protect it from attacks. We do not combine it with other data to identify you.
• Cookies. The Website sets no cookies. We use no analytics, advertising or social-media tracking scripts, and fonts are served from our own site.
• Videos. Some pages contain YouTube videos. The player loads only when you click it, and it uses YouTube’s privacy-enhanced mode (youtube-nocookie.com). Once you play a video, Google’s privacy policy applies to that video.
• Browser tools. Tools on the Website, such as the SCIM tester, run in your browser and send requests only to the address you enter. Those requests and responses do not pass through SSOGEN.
• Email links. “Request a trial” and similar buttons open your own email program, addressed to us. Section 3 covers what happens when you send that email.

If we later add a form, analytics or cookies, we will update this policy before we do.

3. Sales and support

When you email or call us, we receive what you send: your name, email address, phone number, company, job title and the content of your message. For a support request this may include configuration details, log extracts or screenshots.

We use this information to:

• reply to you;
• arrange a trial;
• provide support under your organization’s agreement;
• keep business records; and
• tell you about SSOGEN products when you are a customer or have asked for information.

Every marketing email lets you opt out. Our legal basis is our legitimate interest in answering inquiries and running our business, or the performance of a contract with your organization.

Logs you send us. Before you send logs or screenshots, please remove passwords, keys, tokens and other secrets. If we find a credential in material you sent, we will tell you so that you can change it.

We keep sales correspondence for as long as the business relationship lasts, plus a reasonable period afterwards. We keep support records for the term of the customer agreement plus up to three years, unless the law requires longer.

4. SSOGEN Authenticator app

The App lets you approve sign-ins and generate one-time codes for your organization’s SSOGEN service.

Stored only on your phone:

• the one-time code secrets and account names you add;
• a device signing key that your phone’s secure hardware (Secure Enclave or Android Keystore) creates and protects. The key cannot be exported, and using it requires your biometric check or device passcode; and
• the address of your organization’s SSOGEN server, from the pairing QR code.

These items are excluded from device backups and cloud sync. On a new or restored phone you pair again.

Sent to your organization’s SSOGEN server, not to SSOGEN: when you pair, and when you approve or deny a sign-in, the App sends:

• an installation identifier;
• the push notification token;
• your operating system version, device model family and App version;
• a signal of whether the phone appears rooted or jailbroken; and
• signatures made with the device key.

Your organization uses this data to deliver approval requests and to protect your account.

Push notifications. To wake the App, your organization’s server sends a notification through Apple Push Notification service (iOS) or Firebase Cloud Messaging (Android). The notification carries only a message type, a random reference and an expiry time. It carries no name, email address, application or other content about you. The App then fetches the request directly from your organization’s server. Apple and Google process the push token and delivery data under their own privacy policies.

Camera, biometrics and permissions. The App uses the camera only to scan pairing QR codes and saves no images. Face ID, Touch ID or the Android biometric prompt is checked by your phone’s operating system; the App never receives your biometric data. The App asks for notification permission to show approval requests.

No analytics. The App contains no analytics, advertising or tracking software, and it does not contact SSOGEN’s servers. If you have allowed your phone to share crash reports, Apple or Google may pass anonymous crash data to us through their developer consoles.

Removing your data. Deleting the App removes everything it stored on your phone. To remove the pairing from your organization’s records, use My Account in your organization’s SSOGEN service, or ask your organization’s administrator.

5. Services SSOGEN provides to organizations

Self-hosted SSOGEN. When your organization runs SSOGEN on its own servers or cloud account, all user, sign-in and audit data stays there. SSOGEN does not collect it, and the software does not send it to SSOGEN. We see it only if your organization sends it to us, for example in a support request (section 3).

An organization hosted by SSOGEN. When we host SSOGEN for your organization, we process the following personal data on its behalf:

• your account details (name, username, email address, mobile number, group memberships and other attributes your organization sets);
• sign-in and session records (time, IP address, browser and device information, result);
• the second factors you enroll; and
• audit records of administrative and security events.

We process this data only to provide, secure and support the service, as instructed by your organization in our agreement with it. We do not sell it, use it for advertising, or use it to train AI models. Each hosted organization’s data is kept separate from every other organization’s.

Your organization sets how long audit records are kept, within the limits the service allows. When your organization ends its service, its data is deleted after the notice period in our agreement. Encrypted backups expire within 35 days after that.

Connection relay. If your organization uses SSOGEN’s hosted connection relay, the relay sees the hostname requested, the source IP address, timestamps and the amount of data transferred. It needs these to route and protect the connection, enforce usage limits and answer abuse reports. The relay passes the encrypted connection through without opening it, and SSOGEN does not read or change the content that passes.

Email and text messages. A hosted service sends sign-in and account emails on your organization’s behalf. Text messages are sent through the text-message provider your organization configures.

6. Who we share data with

We share personal data only:

• with service providers that host, deliver or support our Website and Services (such as Cloudflare, email delivery providers and hosting providers). They process it under contracts that require confidentiality and security, and only for the purposes we set. Customers of hosted services can ask us for the current list of subprocessors;
• with Apple and Google, as described in section 4, to deliver push notifications;
• with your organization, where you contact us about its service;
• when the law requires it, or to protect the rights, safety or property of SSOGEN, our customers or others, after checking that each request is lawful; and
• in a business transfer, such as a merger or acquisition, under confidentiality terms. The successor must keep to the commitments in this policy.

We do not sell personal data, and we do not share it for cross-context behavioral advertising.

7. International transfers

SSOGEN is based in the United States, and our service providers may process data in other countries. When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland, we rely on safeguards the law recognizes, such as the European Commission’s Standard Contractual Clauses.

8. Security

We protect personal data with the safeguards we build into SSOGEN itself. These include:

• encryption in transit;
• encryption of stored secrets;
• a separate encryption key for each hosted organization;
• separation between organizations;
• least-privilege access; and
• tamper-evident audit records.

No system is perfectly secure, and we cannot guarantee the security of data sent to us over the internet. If a breach affects your personal data, we will notify you or your organization as the law and our agreements require.

To report a security issue, email support@ssogen.com with the subject “Security”.

9. Your rights

Depending on where you live, you may have the right to:

• know what personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data deleted;
• object to or restrict certain processing, including direct marketing;
• receive your data in a portable format;
• withdraw consent where we rely on it; and
• complain to your local data-protection authority.

California residents. California law gives you the right to know, delete and correct personal information, and to opt out of its sale or sharing. SSOGEN does not sell or share personal information, and it does not use sensitive personal information except to provide the service you requested. We will not treat you differently for using your rights. An authorized agent may make a request on your behalf.

How to make a request. Email privacy@ssogen.com. We will verify your request, usually by confirming control of the email address involved, and answer within the time the law requires: 45 days under California law, one month under the GDPR. If the request concerns data we hold for your organization (sections 4 and 5), we will refer it to your organization, which decides on it.

10. Children

The Website, the App and the Services are intended for organizations and their staff and users. They are not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has sent us personal data, contact us and we will delete it.

11. Changes to this policy

We may update this policy when our products or the law change. We will post the new version here with a new effective date. If a change materially affects how we use personal data already collected, we will give notice on the Website or by email before it takes effect.

12. Contact

SSOGEN Corporation
8585 N. Stemmons Fwy, Suite 412
Dallas, TX 75247, USA

Email: privacy@ssogen.com
Phone: +1 (800) 773-6775