Privacy policy
Last updated:
This policy covers the website pathos.apalala.be and explains what the Pathos software does with data once you install it. It is written under the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Belgian Act of 30 July 2018.
1. Data controller
- Apalala SRL, Ruelle des bois 1, 1325 Longueville, Belgium
- VAT BE0824.660.940
- Email: info@apalala.be
- Help desk: helpdesk.apalala.be
Apalala SRL has not appointed a data protection officer, as the processing described here does not require one.
2. This website
pathos.apalala.be is a static site. It sets no cookies, stores nothing in your browser, and loads nothing from third parties: no analytics, no advertising, no external fonts, no embedded video, no sharing buttons. Fonts and images are served from the site itself.
The web server keeps no access log for this site. Its error log may record your IP address and the requested address when a request fails; it is used only to keep the server secure and working, and is rotated daily and deleted after 10 days.
The site is hosted on a server operated by Apalala at Hetzner Online GmbH, in the European Union.
3. When you contact us
If you write to info@apalala.be or open a ticket on our help desk, we process the data you give us (name, email address, company, message, any attachment) to answer you and, if you ask for it, to prepare a quote or provide support. These exchanges are kept for 24 months at most after the request is closed, or longer when accounting law requires it for a contract.
4. The Pathos software
Pathos is self-hosted: you run it on your own infrastructure, and you are the controller of the data it holds (findings, triage decisions, user accounts, audit log, credentials to your cloud). Apalala has no access to an installation it does not operate for you, and Pathos sends no usage statistics or telemetry.
Pathos only makes the outbound calls below. None of them contains personal data, and each can be switched off.
| Call | What is sent | How to switch it off |
|---|---|---|
Update check on ghcr.io, once a day | A request for the list of published versions (tag names) | PATHOS_UPDATE_CHECK=false |
| Advisory lookups on OSV.dev, the GitHub Advisory Database, ENISA (EUVD), cve.org and FIRST | CVE identifiers only | PATHOS_ADVISORY_LOOKUP=false |
| Connectors you configure (AWS, Microsoft Defender, SonarQube, GitLab, Gitea, your directory) | The requests needed to read your data, with the credentials you entered | Do not configure them; PATHOS_DEFENDER=false blocks Microsoft Defender |
The diagnostic report is never sent automatically. It masks secrets, key identifiers, tokens, AWS account numbers and email addresses; you decide whether to attach it to a message or a ticket.
When Apalala installs or supports Pathos for you and needs access to your installation, the scope of that access and the processing it involves are set out in our agreement.
5. Legal bases
- Our legitimate interest (Art. 6(1)(f) GDPR): keeping the website secure, answering your messages.
- Steps prior to a contract and its performance (Art. 6(1)(b)): quotes, installation and support.
- A legal obligation (Art. 6(1)(c)): keeping accounting records.
We take no automated decision producing legal effects concerning you and carry out no profiling. We do not sell or rent your data.
6. Your rights
You can ask to access, correct or erase your data, to restrict or object to its processing, and to receive it in a portable format. Write to info@apalala.be; we answer within one month. You can also lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, dataprotectionauthority.be.
7. Changes
We update this policy when the site or the software changes. The date at the top shows the latest version.