Privacy notice
How we handle data in the private CertOps pilot and on its sign-in pages.
Controller and contact
Mainframe IT Solutions – Travis Hull
Zum Viadukt 15
64711 Erbach, Deutschland
contact@mainframe-it.com
+49 6062 2630045
Hosting and technical access
This service runs on a Hetzner Online GmbH server in Germany (Industriestr. 25, 91710 Gunzenhausen, Germany). Connecting to it necessarily processes your IP address, request time and browser request information. We use this to deliver the service and maintain its security, on the basis of our legitimate interests under Article 6(1)(f) GDPR. Technical errors may appear in operational logs. Application container logs rotate by size, with up to three 10 MB files per service; this is not a fixed time-based retention period.
Signing in and essential storage
We process your username and verify your password against a salted password hash. Successful sign-in creates a random session identifier in an essential, secure, HttpOnly cookie. It is limited to this app's domain and expires after eight hours at the latest. Signing out revokes that session immediately; restarting the login service also ends its sessions. The server holds session records in memory until expiry, sign-out or restart. Login-attempt counters expire after fifteen minutes and do not store IP addresses.
Authentication and protection against forged requests are necessary to provide the private workspace you request (Article 6(1)(b) GDPR where a contractual relationship applies; otherwise Article 6(1)(f) GDPR for restricted pilot operation and security). Essential cookie storage is based on § 25(2)(2) TDDDG. No advertising or analytics cookies are used on this app.
Workspace data
CertOps stores certificate metadata, endpoints, assigned owners, requests, approvals and audit records you enter or import in a SQLite database on the server. The interface keeps loaded data in memory. Downloaded reports remain on your device until you delete them. The current pilot has no preconfigured scan targets, connected certificate authority or enabled live renewals. External endpoints are contacted only after separate configuration.
Data is accessible to the authorized pilot operator and the hosting provider where required to operate the service. Workspace records and audit entries remain until deleted by the operator; there is no automatic time-based deletion for the pilot. Backup copies may retain older records until the operator removes those copies. Contact us to arrange deletion, including backups, or to clarify retention before uploading personal or business data. If you use the pilot for an organization, that organization remains responsible for the lawfulness of its uploaded data and any necessary processing agreement.
Local files and external services
The login pages use system fonts and load scripts and photographs from this server. They do not embed analytics, advertising, social widgets or external image requests. Links to Mainframe, image credits and the supervisory authority open a separate website whose own privacy notice applies. Contact by email is handled as described in the Mainframe privacy notice.
Your rights
Subject to the applicable legal conditions, you may request access, rectification, erasure, restriction and portability of your personal data. You may object to processing based on legitimate interests, for reasons arising from your situation. Contact the controller above to exercise these rights. You may also lodge a complaint with a supervisory authority, including Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Postfach 3163, 65021 Wiesbaden, Germany.
No automated decision-making or profiling is performed by these login pages. Providing login credentials is necessary to use the restricted workspace; public legal pages remain accessible without them.
Updated: 11 October 2026