Privacy Policy

Who we are

RealmSSO is operated by Peasy Services. For anything in this policy, write to support@realmsso.com.

This website

realmsso.com is a set of static pages. It sets no cookies, runs no analytics, and loads no third-party scripts or fonts. When you open a page, the web server that serves it sees the same thing every web server sees — your IP address, the page requested and your browser's user-agent string — in its ordinary access logs. We do not combine that with anything else.

The site has one form, on the contact page. What you type there — your name, your email address, your company if you give one, and your message — is sent from your browser to our API at api.realmsso.com, which emails it to our support mailbox — through Amazon SES, named below — together with the IP address and browser user-agent of the request, so that we can tell people from bots. Before it sends, your browser solves a small puzzle issued by that same API — a proof-of-work check that runs on your device, uses no third-party CAPTCHA service, sets no cookie and sends nothing about you beyond the request itself, which reaches the API with your IP address. Neither the site nor the API stores what you submit; the email is the only copy, and we keep it for as long as we need it to answer you.

Whether you use the form or write to support@realmsso.com directly, your message is delivered to the same mailbox and kept there for as long as we need it to answer you.

The product

RealmSSO is single sign-on infrastructure. When you or your customers use it, the server stores the following about people:

• Dashboard users (the people who run a RealmSSO dashboard): the email address you sign in with and whether it has been verified. Sign-in is by a one-time link sent to that address; there is no password to store.
• Accounts (your customers): the account name and identifier you give it, and any email domain you register and verify for it.
• SSO connections: the configuration of a customer's identity provider — its entity ID or issuer, sign-on URL, signing certificate, and for OIDC a client ID and secret. The secret and the certificate are encrypted at rest in RealmSSO's database, and the sign-in service keeps its own working copy of each; see Encryption at Rest for exactly which fields and how.
• Admin Portal invitations: the email address and display name of the IT admin you invite at your customer, and the short-lived, single-use session that link opens.
• API keys and webhooks: a hash of each API key (the key itself is never stored), and for webhooks the destination URL and a log of delivery attempts.
• Audit and sign-in events: who did what and when — including the IP address and user-agent of the request — so that an administrator can answer “who changed this?” and “who signed in?”.
• Directory sync (SCIM): when a customer connects their directory, the users and groups their identity provider pushes to us — typically name, email and group membership. The customer's directory is the source of that data and controls it.

People who sign in through a customer's SSO connection authenticate with their own organisation's identity provider. RealmSSO passes that sign-in through and records the event; it does not hold their password. On their first sign-in, the sign-in service creates a user record in that customer's realm with the name and email address their identity provider sends. For an OIDC connection, it also keeps the tokens that identity provider issued.

Why we hold it

To provide the service you asked for: to sign you in, to pass your customers' sign-ins through, to let their IT admins configure their own connection, and to give you an accurate record of what happened. We do not use any of it for advertising, we do not sell it, and we do not send marketing email.

Who else processes it

Amazon Web Services (Amazon SES, US East region) delivers every email the product sends — sign-in links, Admin Portal invitations, and the messages submitted through the contact form. AWS receives the recipient address and the message; for a contact-form message that is everything you typed, together with the IP address and user-agent of the request, on its way to our mailbox. The RealmSSO server sends personal data to no other third party. Mail to support@realmsso.com is forwarded by our domain's mail-forwarding service to a mailbox outside realmsso.com.

We run RealmSSO for you. The product data above sits on the instance described in How we run your instance, and your account has its own realm there: the separate sign-in space we create for each account. We process the data for you under the written agreement that covers Managed and Enterprise.

How long we keep it

For as long as the account it belongs to exists. Deleting an account deletes its configuration, its connections, its audit log and the realm behind them (see Backup & Recovery for what that means operationally). The realm is deleted in a second step, after the account. If that step fails, we record the failure, and the realm can remain. Sign-in links expire after 15 minutes and Admin Portal invitations after 30 minutes; both are single use.

Some records outlast the account. Sign-in and sync events carry an email address and an IP address. We keep them for 90 days by default and then purge them. Deleting an account does not delete them, so they can outlast it by up to that period. After a deletion we keep a record that it happened, and an internal audit log of platform-level actions. A deleted account stays in our nightly backups until each backup reaches 30 days. Your dashboard user record does not belong to one account, so deleting an account does not delete it; write to us to delete it.

Your rights

You can ask us what we hold about you, ask us to correct it, or ask us to delete it. Write to support@realmsso.com from the address in question. If you are an end user of a customer's application, your organisation's administrator controls your directory data; we will help them act on your request.

Changes

When this policy changes in substance, the effective date at the top changes with it. The current version is always at this address.