Privacy policy

Who is the data controller?

The data controller is the website publisher, identified in the legal notice. For any question: contact@firstsi.com.

Data processed on this website

• No tracking cookies: this website uses no advertising cookies, no third-party analytics trackers, and loads no resources from third-party servers.
• Display preference: if you use the light/dark theme toggle, your choice is stored only in your browser (local storage, key fsi-theme), with no identifier and no transmission to the server. This storage is strictly necessary for the feature you requested; you can clear it at any time by deleting the site data in your browser. When you follow a link to the documentation (docs.firstsi.com), your theme is passed in the address (?theme=) and removed from the address on arrival; no cookie is used.
• Anonymous audience measurement: the website server counts, day by day, page views, the number of distinct visitors, the referring page, the language and the country (derived from the IP address using the DB-IP database). A visitor is recognised by a fingerprint computed with a secret renewed every day and never stored: neither the IP address nor the fingerprint is kept, only the daily totals are, for 90 days. No cookie is set.
• Technical logs: like any web server, the hosting provider records connection logs (IP address, pages visited, timestamps) for security purposes, kept for a maximum of 12 months.
• Contact requests: if you write to FirstSI, your email address and the content of your message are used solely to reply to you, then deleted no later than 3 years after the last exchange.

This processing is based on the publisher's legitimate interest (ensuring the security and proper operation of the website) and, for contact requests, on steps taken at your request with a view to a possible contract. No data is used for advertising purposes.

Data processed by the FirstSI platform

FirstSI is an infrastructure monitoring tool. In that context, the client organisation is the data controller and FirstSI merely provides the technical means. Depending on the active modules, the platform processes:

• User accounts: name, email address, role, sign-in log.
• File events: file paths, Windows accounts that accessed the files, timestamps.
• Network flows and DNS queries: internal IP addresses, volumes, queried domains.
• Inventory and software usage: installed software and versions on monitored computers, application usage time per session.
• Active Directory logons: source and target accounts, computers and addresses of logon sessions, to spot abnormal use.
• Network diagnostics on a computer: enabled case by case and with the person informed: link quality (Wi-Fi, gateway, DNS, Internet), foreground application, the computer's IP addresses.
• Database sessions: account, computer and running query on monitored SQL instances.
• Programmatic access: the client organisation may connect its own tools (scripts, SIEM, AI assistants) to a token-based API; every call is logged and data passed to those tools is the organisation's responsibility.

This data is collected exclusively for the security and monitoring of the information system, on the basis of the client organisation's legitimate interest. It is never resold and never used for any other purpose.

Retention periods

• Operational data: retention chosen by the client organisation, from 1 to 365 days (90 by default), applied once automatic purging is switched on. Per-user network traffic aggregates are kept for 60 days.
• Agents on computers: events not yet transmitted are stored locally, capped at 256 MB per module, and removed when the agent is uninstalled.
• Archives: file access events and DNS queries are archived before deletion, unless the client organisation switches archiving off; archives remain covered by the right to erasure.
• Audit trail: kept for 365 days by default, adjustable from 30 days to 10 years, to meet accountability obligations.
• Accounts: deleted when the account is closed or the contract ends.

Your rights

Under the GDPR, you have the right to access, rectify, erase, restrict and port your personal data. The platform includes export and purge tools that allow your organisation to answer these requests.

• If you are a FirstSI client: write to contact@firstsi.com.
• If you are an employee of an organisation using FirstSI: contact your employer first, as the data controller.

You may also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).

Security

The technical and organisational measures protecting this data (per-client isolation, encryption, strong authentication, audit trail) are detailed on the Security & GDPR page.