Legal
Product privacy notice SaQura CertWatch
Last updated: October 28, 2026
Datenschutzhinweis zum Produkt · SaQura CertWatch Product privacy notice · 製品プライバシー通知 Stand / as of: 2026-10-28 · Version 2.0 · gilt für / applies to SaQura CertWatch ab / from 1.3.0 einschließlich / including CertWatch Agent Deutsch: Abschnitte 1 bis 6 · English: sections 1 to 6 below · 日本語：下記第1項から第6項
============================================================
ENGLISH
============================================================
This notice describes what the Software stores on your systems and which
outbound connections it makes. It concerns only the program (server and
CertWatch Agent). For the website, purchasing and the license service, the
privacy notice at https://kyototech.co.jp/legal/privacy also applies. The
contractual rules are in Section 9 of the License Agreement (EULA).
============================================================
1. WHERE THE SOFTWARE RUNS AND WHAT IT STORES
============================================================
SaQura CertWatch runs entirely on your own systems (self-hosted). There is no
service operated by KyotoTech to which your monitoring data flows. Inventory,
check results, grades, reports, the continuous audit chain, logs, settings,
recipients and credentials arise and remain in your installation, namely in
the data folder of the Instance (database and files).
Stored credentials (for example for SMTP, DNS providers and the certificate
authority) are encrypted with an installation key. Depending on the operating
system it is stored in different places:
· Windows: as a file in the data folder, protected by the Windows Data
Protection API (DPAPI) and readable only on the computer on which it was
created,
· macOS: in the keychain,
· Linux: as a systemd credential outside the data folder.
Back up the data folder and the installation key together (EULA Section 4.3).
The CertWatch Agent generates the private key of a new certificate on the
target server and transmits only the signing request to your Instance. It
places certificate and key there and creates temporary backups of the
previous files during deployment. These backups may include the previous key
file; they stay on the target server, are readable only by the agent's
account and are deleted after a rollback or at the next deployment for the
same target.
KyotoTech receives neither your addresses nor your results, reports, recipient
lists or credentials, neither automatically nor during license checks.
KyotoTech has no remote access to your Instance or your agents. The license
file (`.lic`) is verified locally by its signature. A connection to KyotoTech
arises only for license refresh (section 2.6, can be disabled) and for the
notice of new program versions (section 2.4, can be disabled).
============================================================
2. WHICH OUTBOUND CONNECTIONS ARISE
============================================================
In each of these connections the remote side sees the IP address of your
system, as with any request on the internet.
2.1 Your monitoring targets
The Software connects to the addresses and ports you register to check the
certificate, the chain, and the protocol and key quality there. These are
your own systems or systems you are authorised to check (EULA Section 4.1).
2.2 Public certificate logs (inventory discovery, alert on unknown certificates)
To find certificates issued for your domains, the Software queries public
Certificate Transparency logs:
· crt.sh (Sectigo Ltd.)
· api.certspotter.com (SSLMate, Inc.; fallback if crt.sh is unavailable)
Only the domain name searched is transmitted (the registrable domain, for
example `company.com`). No results, port lists, recipients or customer
data are transmitted. The certificate data queried there is public; every
publicly trusted certificate authority publishes it there anyway.
Addresses you remove are no longer queried.
2.3 Revocation services (OCSP/CRL) and intermediate certificates (AIA)
To check whether a certificate has been revoked, the Software queries the
revocation service named in the certificate itself. The identifier of the
checked certificate is transmitted. If a system lacks an intermediate
certificate, the operating system fetches it for the trust check from the
issuing location named in the certificate (AIA). These addresses come from
the certificate authority of the checked system, not from KyotoTech.
2.4 Notice of new program versions
Up to once a day the Software loads a small version file from
https://saqura.de/downloads/certwatch/latest.json and compares the version
stated there with the installed one. No data of yours is sent. The
Software does not update itself; it only points out new versions.
To disable: set the environment variable CERTWATCH_NO_UPDATE_CHECK=1.
Monitoring then continues unchanged.
2.5 Your outgoing mail and your webhooks
The Software sends alerts and reports through the SMTP server you register
and to the webhook addresses you register. A webhook receives the core data
of the alert (address and port, level, subject, record number, time). You determine recipients,
credentials and delivery route; none of this passes through KyotoTech.
2.6 License refresh
In all licensed plans license refresh is switched on by default (gear menu
→ License). The Software then asks https://license.kyototech.co.jp at most
once a day successfully whether a renewed, changed or revoked license
exists; after a network error it tries again after about one hour. In
trial mode without a license it does not ask.
Transmitted are: the product identifier, a hash (SHA-256) of the license
number (not the number itself), the issue date of the installed license
and your setting on whether you want license e-mails. No addresses,
results, reports, recipients or settings are transmitted. If a newer
license exists, it is fetched and installed. If the license has been
revoked, the Software creates no new renewal jobs and no new tenants
(EULA Section 2.10).
KyotoTech is the controller for this data. The legal basis is the
performance of the License Agreement (Art. 6 (1) (b) GDPR). The data is
processed in Japan; the European Commission has adopted an adequacy
decision for Japan.
To disable: gear menu → License → switch off "Renew license
automatically", or set the environment variable
CERTWATCH_NO_LICENSE_REFRESH=1. You then receive the license file by
e-mail at each renewal and place it yourself.
2.7 Certificate authority (only with automatic renewal switched on)
The Software applies for a new certificate through the ACME protocol at
the certificate authority you choose (default: Let's Encrypt). Transmitted
are the signing request with the names to be certified and the account
data needed for the ACME protocol (account key and, if you wish, an
account binding of the certificate authority). The Software does not
register a contact e-mail. The certificate authority publishes issued
certificates with all names they contain in public Certificate
Transparency logs. The terms and privacy notice of the certificate
authority apply to this processing.
2.8 DNS providers and name servers (only with automatic renewal switched on)
To prove control of the domain, the Software temporarily creates a
validation record at the DNS provider you set up (currently Cloudflare or
Azure DNS, including a zone at these providers delegated by CNAME) and
removes it afterwards. Your credentials for this provider and the
validation record are transmitted. To check whether the record is visible,
the Software also queries the authoritative name servers of the affected
zone and the resolvers configured on your system directly (DNS, port 53).
2.9 CertWatch Agent (only with automatic renewal switched on)
The agent opens the connection to your Instance itself (port 5443 of the
Instance by default; this port is active only while automatic renewal is
switched on), optionally through a local HTTP proxy. It transmits the
signing request and status messages and receives the new certificate. The
private key does not leave the target server. The agent connects to no
other destination, including KyotoTech.
2.10 External check after deployment
After a deployment the Software checks from outside whether the new
certificate is being served. This is a connection as under 2.1.
============================================================
3. WHICH PERSONAL DATA ARISES
============================================================
The Software is designed for technical data (addresses, ports, certificates).
Personal data can arise through:
· e-mail addresses of recipients of alerts and reports,
· user names and login data of the interface,
· addresses that relate to persons (for example `john-doe.com`),
· names in certificates (for example in personal certificates).
You are the controller for this data within the meaning of the GDPR.
KyotoTech is not a processor for your installation because KyotoTech has no
access to it; a data processing agreement is therefore not required for
self-hosted operation. In support, send personal data only to the extent
needed to analyse the issue, and shorten it beforehand where possible. If
processing on your behalf becomes necessary, KyotoTech provides a data
processing agreement on request (EULA Section 9.4).
Retention: check results, reports and the audit chain in the database are
kept for as long as you keep them. The exception is the text log file: it is
rotated at 5 MB, and the older rotation is deleted. The audit chain in the
database is not affected. The backups the agent creates during deployment
are temporary. You can delete inventory, reports and logs in your
installation at any time. Note that deleting entries of the audit chain
breaks the chain of evidence; making that visible is its purpose.
============================================================
4. IF YOU MONITOR SYSTEMS OF YOUR CUSTOMERS (tenants)
============================================================
If you operate CertWatch for end customers, you are responsible towards them
for selecting addresses, domains and servers, for recipients and for
retention. Before monitoring and before any automatic renewal you obtain your
end customers' consent (EULA Sections 4.1 and 4A.4). The Software separates
tenants in inventory, recipients and reports; you assess the legal nature of
your relationship with your end customers yourself.
============================================================
5. CONTACT
============================================================
KyotoTech LLC (合同会社KyotoTech) · Kyō-machi 2-237-202, Fushimi-ku,
Kyoto 612-8083, Japan · support@kyototech.co.jp
============================================================
6. VALIDITY
============================================================
This notice describes the behaviour of the program version it accompanies.
If the behaviour changes, this notice changes with the next version.