Privacy notice SaQura CertWatch Agent

Privacy notice · SaQura CertWatch Agent
Datenschutzhinweis · 製品プライバシー通知（エージェント）
As of / Stand: 2026-10-28 · Version 2.0 · applies to / gilt für CertWatch Agent from / ab 1.3.0

English: sections 1 to 5 · Deutsch: Abschnitte 1 bis 5 · 日本語：第1項から第5項
The privacy notice of the CertWatch server (PRIVACY.txt) and Section 9 of the
License Agreement (EULA) apply in addition.

============================================================
ENGLISH
============================================================

============================================================
1. WHAT THE AGENT DOES
============================================================
The CertWatch Agent runs on your target server. It receives renewal jobs
from your own CertWatch server (your "Instance"), generates the key and the
signing request for a new certificate, deploys the certificate into the web
server and checks whether it is being served. It is active only if you
install it and register it with your Instance.

============================================================
2. WHERE THE AGENT SENDS DATA
============================================================
2.1 Your Instance only
    The agent connects exclusively to the Instance you entered at
    registration, outbound over HTTPS, and only through a proxy if you set
    one explicitly. It does not connect to KyotoTech, to the certificate
    authority or to DNS providers; your Instance handles those connections.
    It transmits:
      · at registration: the one-time registration code, the public key of
        the agent, a name (by default the computer name) and the operating
        system type (Windows, Linux, macOS),
      · during operation: signed status queries, and for each job the job
        and target number, the signing request (with the names to be
        certified), the result and fixed error codes.
    The private key of the certificate is never transmitted.

2.2 Your web server
    After deployment the agent checks the certificate served by connecting to
    the address and port of the target configured by you. Only the
    certificate served there is compared.

In each connection the remote side sees the IP address of the target server.

============================================================
3. WHAT THE AGENT STORES ON THE TARGET SERVER
============================================================
  · Agent state (address of your Instance, agent number, expected server
    certificate fingerprints, the agent's own key): in a protected store,
    on Windows encrypted with the Windows Data Protection API (DPAPI) under
    ProgramData\SaQura\CertWatch-Agent\state, on Linux and macOS under
    /var/lib/certwatch-agent with access only for the agent's user.
  · Configuration (targets, optional proxy): agent.json under
    ProgramData\SaQura\CertWatch-Agent (Windows) or /etc/certwatch-agent
    (Linux, macOS).
  · Private key of a new certificate: in the protected store until
    deployment, then only in the location of the web server you configured.
  · Temporary backups of the previous certificate, key and configuration
    files for restoration during deployment (nginx). They stay in the same
    folder on the target server, are readable only by the agent's account
    and are deleted after a rollback or when the next deployment for the
    same target begins. On IIS the previous certificate remains in the
    Windows certificate store. The agent's journal contains no private key.
  · Log: the agent writes fixed messages with numbers, steps and codes to
    the error output, which your service manager (for example systemd or the
    Windows service) records. It writes no keys, one-time codes or
    signatures to the log. Retention follows your system settings.

============================================================
4. PERSONAL DATA AND RESPONSIBILITY
============================================================
Personal data may arise through the computer name and through names in
certificates. You are the controller for this data. KyotoTech receives no
data from the agent and has no access to it.

============================================================
5. CONTACT
============================================================
KyotoTech LLC (合同会社KyotoTech) · Kyō-machi 2-237-202, Fushimi-ku,
Kyoto 612-8083, Japan · support@kyototech.co.jp
This notice describes the agent version it accompanies.