Data and security
This page contains an overview of data management and security aspects of the Screenful service, including information on our GDPR compliance and our data retention policy.
The EU General Data Protection Regulation (GDPR) sets a new standard for how companies use and protect data taking effect from May 2018.
Screenful is committed to compliance. Key aspects are listed below.
A list Personal data items
Screenful stores the following personal data for our users.
- Full name
- First signed up
- Last seen
- Last login
- Is signed up for weekly emails
- User role (member, observer, account contact)
- For paying customers: Which plan are the subscribed to
- Company name, address, VAT number
- Task management tool that user uses
- City and country (calculated by user’s IP address location)
- Activity log: Events that indicate actions taken by user, for example inviting new users, creating new dashboards or subscribing to automatic reports
Data Persistence and Removal
All customer data is deleted when a customer cancels their subscription. All data related to one dashboard is deleted when customer removes the dashboard. Trial accounts are deleted two weeks after the trial ends. An off-line backup of the data is carried out every day. These backups are stored for a maximum of 30 days.
Within an existing account a users data is removed when that user is deleted from the account.
Location of Data
The Screenful service including all customer data is hosted in the EU.
A list of 3rd party services
Screenful uses the following 3rd party services. This list has been updated on June 15th 2018,
Hosting and storing data
Sending transactional emails, like user invites and weekly digests
- Mailgun - https://www.mailgun.com/privacy-policy
Analytics, CRM and non-transactional emails
- Google Analytics - https://policies.google.com/technologies/partner-sites
- MailJet - https://www.mailjet.com/security-privacy/
- SignupLab - https://signuplab.com
- Capterra - https://www.capterra.com/legal/privacy-policy
- Stripe - https://stripe.com/fi/privacy
- Moonclerk - https://www.moonclerk.com/privacy-policy
- ChargeBee - https://www.chargebee.com/privacy
If you have data related requests get in touch by emailing email@example.com.
The Screenful service runs in a secure hosted environment on Heroku and Amazon Web Services. The Screenful app runs on the customer’s device, which can be for example a laptop or a tablet.
Authentication and Authorization
Customers are authenticated with a username and password by the Screenful app to prevent unauthorized access to the dashboards. Only passwords hashes are stored.
A token is generated by the service upon login. All further requests to the Screenful service are authenticated with the token. The token is validated and before serving each request, and the account id contained in the token is used to authorize the request, so users can only access data from their own account.
There are two user roles 'member' and 'observer'. The latter one is limited to only viewing the data. User roles can be managed at the User Management section of the Settings window.
Access to External Data Sources
Screenful dashboards provide visual analytics based on customers’ existing data in external data sources. Thus customers must give access to these systems. The credentials and access keys to the data sources are encrypted in storage.
Access can and should be limited to specific data sets in the source systems. In the case of task management systems, such as Jira or Trello, this means giving access to only certain boards or projects. Only read-only privileges are needed.
Stored Data Items
Screenful stores only data that is necessary to provide the dashboard views. For task management systems this includes
- Project and/or board name and id, board type, board columns/lists
- Task name, id, status, type, history, assignee avatar and name, and other properties such as label, version, component, work estimates
- Workflow states (e.g. Open, In progress, Done)
- Sprint or iteration name, id, status, goal and duration
- Custom field names
- Custom field contents, if and only if customer has explicitly enabled the field for Screenful use
For example attachments, task descriptions, comments are not stored. Naturally all the calculated metrics and analytics are stored.
All data is encrypted using TLS (SSL) while in transit. Credentials and access keys to external data sources are also encrypted when in storage.
Our status and incident communication site is located at http://status.screenful.com.