Privacy Notice

This instance may process the following categories of data:

• Account data such as username, email address, role status, and password hash.
• Security and session data such as session IDs, password-reset tokens, MFA challenges, source IP, user agent, and timestamps.
• Usage and content data from uploaded training cases, upload files, bundles, and administrative actions.
• Audit and abuse-prevention data for access protection, rate limiting, diagnostics, and traceability of security-relevant changes.

• Providing registration, login, account management, and upload functionality.
• Securing accounts through session handling, CSRF protection, password reset, and admin MFA.
• Abuse detection, rate limiting, auditing, and technical stability of the service.
• Sending transactional emails for password reset and admin MFA when email features are enabled.

Where GDPR applies, processing typically takes place to provide the service and to protect legitimate security and operational interests.

The application is hosted on infrastructure in Ashburn, Virginia, USA. Personal data may therefore be processed or stored in the United States.

If email features are enabled, the configured SMTP service is also used: smtp.strato.de.

Before operating this publicly, you should verify that your specific setup has a documented and valid basis for any third-country transfer that applies.

• Sessions: up to 30 days.
• Password reset tokens: up to 7 days.
• Audit logs: up to 180 days.
• Uploads: up to 365 days.
• Bundles: up to 365 days.
• Backups: up to 30 days.
• Rate-limit data: up to 7 days.

• Login uses the technically necessary session cookie training_hub_session.
• Forms use the technically necessary CSRF cookie training_hub_csrf.
• The current application path does not implement advertising or marketing cookies.

These storage mechanisms exist to operate the service securely and to protect it against abuse.

Where applicable data protection law applies to this service, data subjects may have rights including access, rectification, erasure, restriction of processing, and objection.

Requests can be submitted through the privacy contact listed above. Depending on the applicable law, there may also be a right to lodge a complaint with a competent supervisory authority.

Password reset and admin MFA may send transactional emails. The metadata required for delivery is transmitted to the configured mail service.