سياسة الأمن والاحتفاظ بالبيانات

برنامج الأمن

نطبّق ضمانات إدارية وتقنية وتنظيمية مصممة لحماية المنصة وما تحتويه من معلومات سرية عن المشاريع ورأس المال والمؤسسات. وتشمل هذه الضمانات ضوابط الوصول، وتشفير النقل، وترويسات الأمن وسياسة أمن المحتوى، والإدارة بأقل الامتيازات، وتسجيل التدقيق للإجراءات الحساسة. ولا يوجد نظام آمن تمامًا، ونحن لا نضمن أمنًا مطلقًا.

What We Monitor

For authenticated platform accounts we record the in-app activity listed below, for auditability and support. Two limits are stated here rather than left to inference: this activity stream is written to local storage in the browser you are using and is read back from there — it is not yet a server-side log — and the platform events written to a server-side audit table today are limited to the following: administrative decisions on registrations, access requests and data-room requests, and the welcome email sent to a registered account; an administrator assuming another persona; and the creation, amendment or removal of a project record, which any member of that project can do and which records the field values submitted.

• Sessions & environment — a locally generated session identifier, the start of a session in a browser tab, and the device type, browser, operating system, and screen size your browser reports. Sign-out, session duration, IP address, IP-based location, and network provider are not recorded in this platform activity record: it has fields for IP address and IP-based location, which are left empty, and no field at all for sign-out, session duration, or network provider. An earlier version of this page listed them as recorded, which overstated what is implemented.
• In-app activity — pages and modules opened, projects and capital rooms viewed, documents viewed or downloaded, and searches. Form submissions are not recorded in this stream; an access request and the decision on it are stored with the request itself, not here.
• Security events — the browser-local activity stream carries a result field and a coarse in-app risk weighting, but no permission-denied or error outcome is written to it today. Detection of failed sign-ins, unusual download volume, and new-device or new-location logins is not yet implemented: a failed sign-in writes no record anywhere today. An earlier version of this page described those as monitored.

Where we do derive location from an IP address — for public-site page requests, not for in-platform activity — it is approximate and is not a verified physical address. We do not conduct covert screen recording; where activity reconstruction is needed, it is assembled from the event log described above. We do not sell activity data.

Administrative Access (Tiered)

Access to monitoring and analytics is restricted by role, on a need-to-know basis. Administrative decisions — approving or rejecting a registration, sending a welcome email — are recorded in an append-only audit table. Administrative reads are not yet recorded: an administrator opening the visitor analytics or a project workspace leaves no audit entry today. An earlier version of this page said every administrative access was logged, which overstated what is implemented.

• Analytics Viewer — aggregate analytics only.
• Security Admin — login, IP, security, and risk records.
• Compliance Admin — audit logs, legal flags, and public-records review.
• Platform Admin — operational and usage analytics.
• Super Admin — full visibility across the platform.

جدول الاحتفاظ بالبيانات

ما يلي أهداف مرجعية؛ وتخضع المدد الدقيقة لمراجعة المستشار القانوني وقد تختلف بحسب الولاية القضائية وأوامر الحفظ القانوني:

• Security event logs — 1–7 years (a target for server-side security logging, which does not exist today)
• Audit records of administrative decisions — 3–7 years
• Login / session records — 1–3 years (a target; no login or session record is created today — see What We Monitor)
• سجلات الوصول إلى المستندات — من 3 إلى 7 سنوات
• تحليلات الصفحات والتفاعلات — من 12 إلى 24 شهرًا
• التحليلات الإجمالية / المجرَّدة من التعريف — تُحفظ لمدة أطول
• سجلات التصدير — من 3 إلى 7 سنوات
• سجلات الدعم — من 2 إلى 5 سنوات
• سجلات الحسابات المحذوفة — بالقدر الذي يقتضيه القانون فقط
• السجلات الحساسة الخاصة بشؤون القبائل (Tribal Affairs) — قواعد خاصة للاحتفاظ والحذف معتمدة من الحوكمة، مع حماية سيادة البيانات وضوابط وصول صارمة.

الضمانات والحوكمة

• وصول قائم على الأدوار إلى جميع أدوات المراقبة والتحليلات.
• تقليل البيانات — نجمع ما يتطلبه الإشراف والأمن، لا أكثر.
• إخفاء الحقول الحساسة وضوابط التصدير، مع اشتراط الموافقة على عمليات التصدير الحساسة.
• مراجعة قانونية لأي ميزة حساسة من حيث المراقبة قبل إطلاقها.
• عدم بيع بيانات نشاط المستخدمين؛ ولا تتبع خفي يتجاوز ما نفصح عنه.

Server-side capture is active

Server-side capture is deployed. Page requests are recorded on our servers, including the country, region, city and time zone derived from your IP address and the network provider it belongs to. Your IP address itself is not stored: it is salted and hashed so a visit can be counted without retaining an identifier. The Privacy Policy describes what is collected and why. An earlier version of this notice said server-only signals such as IP address and geolocation were not collected; that described a prototype phase that has ended and was inaccurate while server-side analytics were live.

الإبلاغ عن مشكلة

للإبلاغ عن ثغرة أمنية أو عن أي قلق بشأن كيفية مراقبة النشاط أو الاحتفاظ به، تواصل عبر applied@thecefa.org.