1. Who is responsible
Asterio Group AB, registration number 559289-1856 (VAT number SE559289185601), Ekebovägen 14, 663 32 Skoghall, Sweden, is the controller for the processing described in this notice: operating the portal, keeping the account and access records of the people who sign in, and securing the service. Contact: forge@asterio.se. Asterio has not appointed a data protection officer; questions about data protection go to forge@asterio.se.
Where Asterio processes device and deployment data on the instructions of the organisation that subscribes to Forge (your organisation or the organisation whose tenant you manage), Asterio acts as that organisation's processor under the Data Processing Agreement. For that processing your organisation is the controller and its own privacy notice applies.
2. Who this notice covers
- People who sign in to the Forge portal with a Microsoft Entra account: employees and contractors of Forge customers, and Asterio's own administrators.
- People whose details appear in deployment data because they operate a device being deployed, for example the person at the device whose public network address is recorded with a deployment request. Asterio does not know who these people are; the information in this notice reaches them through their organisation.
3. What personal data we process and where it comes from
| Category | Data | Source |
|---|---|---|
| Account identity | Display name, e-mail address or user principal name, Microsoft Entra object ID, Entra tenant ID | The Microsoft Entra sign-in token when you first sign in; or the object ID alone when a workspace administrator prepares your access before your first sign-in |
| Access record | Your role in each workspace (View only, Deployment access, Workspace administrator, or Blocked), when the record was created and changed, who changed it, and when you were last seen (refreshed at most every 15 minutes) | Forge |
| Actions you take | Approvals and denials of deployments, device codes you enter and the workspace you choose, device removals, changes to workspace settings (registered networks, approval rule, zero-touch, Boot from home, Autopilot, Sentinel, site delivery), cache enrolments and revocations, acknowledgements of notifications, each with your object ID and the time; incident access opened by a Forge administrator also records the reason text they enter | Forge |
| Device-side data linked to your work | The public IP address of the device you deploy (recorded on its claim and deployment request, and the address an approval is bound to), device serial numbers, models and names in deployment records, and the device log bundles a device uploads (Windows Setup, DISM and driver logs, network and disk configuration, firmware and manufacturer facts) | The device; log bundles are redacted of tokens, proofs, passwords, claim codes and hardware hashes before upload |
| Technical | The network address of your browser's requests, used in memory to apply request rate limits; the sign-in tokens the Microsoft Authentication Library keeps in your browser's session storage | Your browser |
Forge does not collect your password (it stays with Microsoft), sets no cookies of its own, uses no analytics or advertising trackers, and determines no location beyond the network address of requests. The portal connects only to Forge and to Microsoft's sign-in service.
4. Why we process it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Signing you in, checking your workspace role on every request, and showing you the deployments, devices and users of your workspace | Legitimate interest (Article 6(1)(f)) in providing the service that your organisation has subscribed to and in enforcing its access decisions |
| Recording who approved, denied, claimed, removed or changed what, and when | Legitimate interest (Article 6(1)(f)) in the security and traceability of a service that erases disks and installs operating systems on request; the records protect your organisation and Asterio |
| Rate limiting and protecting the service against abuse | Legitimate interest (Article 6(1)(f)) in the security of the service |
| Supporting your organisation and investigating incidents | Legitimate interest (Article 6(1)(f)) in operating the service and fulfilling Asterio's agreement with your organisation |
| Complying with legal obligations, such as accounting and responding to lawful requests | Legal obligation (Article 6(1)(c)) |
Forge takes no decisions about you by automated means that have legal or similarly significant effects. Automatic approval of recognised devices (zero-touch) is a setting your organisation controls and concerns devices, not people.
5. Who receives the data
- Asterio personnel. Forge administrators at Asterio can see the workspaces, users and deployment records of every customer in order to operate the service and provide support. Access is authenticated and recorded, and limited to people who need it.
- Your organisation. Workspace administrators of your organisation see your name, e-mail address, object ID, role and last-seen time under User access; users of your workspace see which deployments you approved or denied in the deployment history.
- Microsoft. Sign-in is performed by Microsoft Entra ID; Microsoft processes your sign-in under its own terms and privacy statement as an independent controller for its sign-in logs. Forge is hosted in Microsoft Azure, where Microsoft acts as Asterio's processor (see the sub-processor annex of the Data Processing Agreement).
- Your organisation's Microsoft Sentinel workspace, if your organisation enables the export of deployment events. The export contains deployment identifiers, event codes, stages and times; it contains no user names, e-mail addresses, serial numbers, tokens or raw logs.
- Authorities, where Asterio is required to disclose data by law.
Asterio does not sell personal data and does not use it for advertising.
6. Transfers outside the EU/EEA
Forge is hosted in Microsoft Azure's Sweden Central region. Asterio does not transfer your personal data outside the European Union or the European Economic Area. Microsoft Entra ID is a global Microsoft service; any transfer Microsoft performs for sign-in is governed by Microsoft's commitments to its customers, including the European Union Data Boundary and the standard contractual clauses in Microsoft's data protection terms.
7. How long we keep the data
| Data | Retention |
|---|---|
| Account identity and access record | For as long as you have access to a workspace. When a workspace administrator removes you, the record is kept as workspace history (shown under "Show removed users") until your organisation's data is deleted under section 11 of the Terms of Service |
| Audit records of actions | Kept append-only with the customer record for the life of your organisation's subscription, then deleted with its data |
| Deployment timelines | Kept with the deployment record; there is no age-based purge |
| Device log bundles | Deleted 30 days after upload |
| Sign-in tokens in your browser | Held in session storage and cleared when you sign out or close the browser tab |
| Database backups | Point-in-time backups are kept for 35 days and then expire |
| Platform audit logs (Azure Key Vault) | 30 days; they contain no user identities |
8. Your rights
Under the GDPR you have the right to access the personal data Asterio holds about you, to have inaccurate data rectified, to have data erased, to restrict processing, to receive data you provided in a portable format, and to object to processing based on legitimate interests. Your access to a workspace is decided by your organisation; ask your workspace administrator to change or remove it. For everything else, contact Asterio at forge@asterio.se. Asterio may need to verify your identity and will answer within one month. You also have the right to lodge a complaint with a supervisory authority, in Sweden the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), or with the authority of the country where you live or work.
9. How the data is protected
Sign-in is delegated to Microsoft Entra ID; Forge never sees your password. Every request is checked against your role and your organisation's workspace on the server. All connections use HTTPS. Data is encrypted at rest in Azure, databases and storage are reachable only through private endpoints, and the public portal has no direct access to the database, storage or signing keys. Device proofs are stored as hashes, and secrets are redacted from logs. The technical and organisational measures are described in the annex of the Data Processing Agreement.
10. Changes to this notice
Asterio may update this notice when the service or the law changes. The current version and its effective date are stated below, and material changes are announced in the portal.
Version 1.0. Effective 9 October 2026.