This document is available in English only. For questions contact legal@ojava.ch
Privacy policy
Last updated: 15 May 2026
Who we are
Ojava is operated by Ojava SA, registered in Geneva, Switzerland. For the purposes of the Swiss Federal Act on Data Protection (FADP/nDSG) and the EU General Data Protection Regulation (GDPR), Ojava acts as a data processor on behalf of your organisation, which is the data controller.What we collect
To monitor your cloud accounts for attacks, Ojava ingests:
- Sign-in events (timestamp, source IP, geolocation, user agent)
- Mailbox-rule changes (rule definition metadata)
- OAuth grant events (granted scopes, app metadata)
- MFA challenges (success/failure outcome only)
- Admin actions (privilege changes, user creation)
- Drive and OneDrive access metadata (file ID, action, no content)
For your Ojava account itself we collect: email, name, password hash, role, last sign-in, and notification preferences.
What we do NOT collect
We never download or store the content of your emails, attachments, OneDrive files, Drive files, or chat messages. We never store full file contents anywhere in our systems. If a detection rule needs metadata about a file, we keep only the metadata (path, size, action), never the bytes.AI processing (Anthropic)
To explain alerts and generate weekly reports we send anonymised alert summaries (no email content, no attachment content, no client names beyond what you choose to include in titles) to Anthropic (model:claude-sonnet-4-…). Anthropic is contracted as a sub-processor and does not retain your data for model training (per their Zero-Data-Retention agreement). The full sub-processor list is available in our DPA.Data retention
- Identity events: 90 days
- Alerts: 12 months
- Incidents: 24 months
- Audit logs: 24 months
- Account data: until account deletion + 30 days
Backups are retained for 30 days and stored encrypted in the EU.