Data protection and GDPR

Roles under the GDPR

Your organisation is the controller of the personal data in GoProject. The product needs no outbound connection to work. One exists, and on a new installation it is off: once switched on, every hour it tells the GoProject portal (goproject.lv) which licence it runs, its installation ID and public key, how many seats are in use and when the licence key was issued. The report carries no personal data, and a system administrator switches it on or off under Administration, Licence (Synchronise with the GoProject portal). Every other outbound connection exists only once an administrator sets it up: mail, your directory and single sign-on, Git servers, Google Drive, Slack and Microsoft Teams, a language model of your own or a cloud one, imports, forwarding the audit trail, and the web requests of automation rules.

What personal data the system holds

• Account data: name, e-mail, language, time zone, avatar, and profile fields such as job title and department, some of them read from your directory
• Activity data: work items, comments, attachments, work logs, documents, chat messages, conversations with the help assistant, and audit log entries recording who did what and when; sign-ins also record the address they came from
• Help Desk customer data: name, e-mail, organisation and the tickets they raised, including letters received by mail

Deactivation instead of deletion

People are never deleted, only deactivated. Deactivation ends every active session, and history stays consistent. GoProject has no built-in tool for anonymising or exporting one person's data.

Who can see whom

• Finding people (Administration, Security, Sharing and limits): everybody finds everybody, or only the people they share a project, a space or a group with
• External accounts (clients and partners) are found only by people who share a project with them; they do not appear in search, the share dialog or people lists
• Help Desk customers see only their own tickets unless the Help Desk's switch Customers see their organization's tickets is on; then they also see the tickets of the other members of their organisation
• Public document links can be switched off, which stops every link already handed out, and given a maximum lifetime

Security measures

• Passwords hashed with Argon2; directory passwords are never stored
• Two-factor secrets sealed with a key that is kept outside the database
• Sessions stored server-side, with idle and maximum length set by the administrator
• Sign-in protection against guessing, and a configurable password policy
• Append-only audit log with an export for your SIEM; administrators viewing the system as another user is audited too

Documents for your DPO

A data processing agreement template and a description of technical and organisational measures are available from LTECH on request. Write to [email protected].