EdgePortal Privacy Policy

EdgePortal is developed and operated by EdgeSearch Labs LTDA (CNPJ 51.041.628/0001-76), headquartered at Av. Bento Munhoz da Rocha Netto, 632, Torre Norte, 19º Andar, Maringá/PR, Brazil. EdgeSearch Labs LTDA is the data controller for the personal data described in this policy.

This policy applies to EdgePortal, our FinOps platform for Cloud, SaaS and AI, including installations of EdgePortal listed and provisioned through the Microsoft Azure Marketplace.

EdgePortal collects and processes the following categories of data:

• Account and profile data — name, email, user ID, role and authentication credentials, provided when an account is created or a user is provisioned.
• Platform usage data — login timestamps, features accessed, search queries and templates used within EdgePortal.
• Cloud cost and inventory data — cost, billing and resource inventory data obtained through integrations the customer explicitly authorizes with their cloud accounts (Microsoft Azure, AWS, Google Cloud, Oracle Cloud, Kubernetes, Proxmox and VMware).
• Technical and infrastructure data — IP address used to access the portal, application logs, and resource usage of the EdgePortal services themselves.

When a customer connects EdgePortal to a Microsoft Azure subscription, EdgePortal requests access to a limited, customer-authorized set of Azure APIs, specifically:

• Azure Cost Management API — read-only access to billing and cost data, used to power cost visibility, allocation, budgets, anomaly detection and FinOps reporting.
• Azure Resource Health — read-only access to maintenance and service-health signals, used to power Cloud Lifecycle Intelligence (end-of-support and maintenance calendars).
• Microsoft Graph (Azure AD) — read access to directory user listings, used solely to support role-based access control (RBAC) and to let administrators assign EdgePortal permissions to existing Azure AD identities. EdgePortal does not modify Azure AD objects and does not use Microsoft Graph data for any purpose other than access management within EdgePortal.

All of the above access is granted explicitly by the customer through their own Azure tenant (via service principal or equivalent credentials configured by the customer) and can be revoked by the customer at any time by removing the corresponding permissions in Azure. EdgeSearch Labs LTDA never accesses Azure resources or Azure AD data without an active, customer-configured connection.

Data described in Sections 2 and 3 is used exclusively to provide, operate, secure and support EdgePortal: account and access management, cost visibility and allocation, inventory and lifecycle intelligence, optimization and automation features, and customer support. We do not sell personal data and we do not use customer cost or infrastructure data to train third-party AI models.

We do not share customer data with third parties except: (a) infrastructure and sub-processors strictly necessary to operate EdgePortal (e.g., cloud hosting), each bound by confidentiality and data-processing obligations; (b) when required by law or a valid legal request; or (c) with the customer's explicit consent. We do not share data with Microsoft beyond what is inherent to the customer's own use of the Azure APIs described in Section 3.

Cloud provider integration credentials (including Azure service principal credentials) are stored in a dedicated, encrypted credential vault (AES-256-GCM) isolated per customer, and are never stored in plain text. All communication with cloud provider APIs and with EdgePortal is encrypted in transit (TLS). Access to EdgePortal is protected by role-based access control (RBAC) and a full audit trail.

Account and profile data is retained for the duration of active use plus 6 months. Platform usage data is retained for up to 12 months. Cloud cost and inventory data is retained for the period defined in the customer's service contract. Technical/application logs are retained for up to 24 months. Upon contract termination or written request, customer data is deleted or anonymized within a reasonable period, except where retention is required by law.

Subject to applicable law (including LGPD and GDPR), data subjects may request confirmation of processing, access to their personal data, correction of inaccurate data, anonymization, blocking or erasure, data portability, objection to processing, and information about data sharing. Requests can be sent to the contact below.

EdgePortal may process data in infrastructure located outside the customer's country. Where this involves cross-border transfer of personal data, EdgeSearch Labs LTDA adopts contractual and technical safeguards consistent with LGPD and, where applicable, GDPR requirements.

EdgePortal is a business-to-business product and is not directed at, or knowingly used by, children.

We may update this policy from time to time. Material changes will be reflected by updating the date at the top of this page. Continued use of EdgePortal after a change constitutes acceptance of the revised policy.

For privacy questions or to exercise your rights, contact us at [email protected].