Security and Data Handling

Service provider: BentoBits Inc.

Scope

BentoBits Inc. operates Rowseta. This page explains how Rowseta handles customer data and the principal safeguards used by the service. The Terms of Service and Data Processing Agreement set out our contractual obligations. The Privacy Policy explains personal data processing, retention, and individual rights.

This page does not create a separate uptime, support-response, backup-restoration, or disaster-recovery service level. It does not reduce the safeguards or obligations required by the Data Processing Agreement or applicable law.

Storage and processing locations

Global is the only storage location currently offered for stored analytical files, billing measurement files and uploaded in-app report media. Global has no guaranteed storage location. This does not describe every category of information or every place where data is processed.

Application processing, including queries and billing measurement, takes place in Canada. Cloudflare's network terminates TLS and proxies web traffic worldwide. Platform metadata, such as account, membership, configuration, billing, and written in-app report records, is also processed in Canada. Temporary working data can be created during processing, outside the content-storage location.

Service providers may process information in additional countries, as described in the Privacy Policy and applicable provider disclosures. Required international-transfer arrangements must be in place for the relevant processing.

Organization access and identity

Rowseta separates Organizations' stored analytical files and applies Organization-specific authorization to service access and queries. Customer administrators manage their members and permissions within the service's access rules.

For learning-platform launches, Rowseta validates the Organization's registered launch configuration and uses the validated platform issuer and subject identifier within that Organization to identify a member. Email addresses and display names do not establish or merge launch identities. Launch-created members are restricted to analytics permissions unless an authorized administrator records a permission-ceiling lift. Access through a Brightspace course launch is restricted to that course by default. If an authorized administrator explicitly grants a member broader main-app access through an eligible Rowseta role, that member can use the role's permissions within their Organization in the main Rowseta app, even when entering through a course launch. Embedded widgets and their detail views remain restricted to the launch course, including for those members.

Customers remain responsible for the access they authorize, the credentials they supply, and their own systems and devices. These responsibilities do not replace BentoBits' obligations for the service.

BentoBits personnel and service-provider access

Authorized personnel may access customer data when necessary to operate, secure, maintain, troubleshoot, or support Rowseta, subject to confidentiality and applicable access restrictions.

Interactive support viewing of synced LMS data and other Organization records, such as people, reports and insight widgets, uses read-only, time-limited support sessions. Authorized support staff can view the ticket submitter's name, email address and role, along with the Organization's plan, account status and Rowseta address, without opening a support session. Synced LMS data may include learner information. This describes the interactive support facility; authorized operational maintenance, incident response, and deletion can require other forms of access.

Necessary support and operational access is recorded, including access to investigate problems BentoBits identifies itself. Authorized customer representatives may request their Organization's access records through the website contact form. We do not seek separate approval or send a routine notice for each access already authorized by the Data Processing Agreement, unless an applicable legal or contractual requirement says otherwise. Personal data breaches are handled under the Data Processing Agreement's separate notification requirements.

Providers that help deliver the service may also process data for their assigned functions. Personnel access is not a representation that no service provider, legally authorized recipient, or required disclosure can involve the information.

Encryption

Rowseta encrypts stored learning-platform credentials at the application level. Its infrastructure providers supply encryption for stored service files and platform metadata volumes. Metadata backups use server-side encryption.

Application endpoints use HTTPS. The public service is configured to redirect HTTP requests to HTTPS, require TLS 1.2 or newer, and use HTTPS with certificate validation between the edge network and application servers.

Encryption does not prevent authorized processing or replace access control, appropriate configuration, and customer handling of exports.

Logs, backups, and temporary data

Technical logs support diagnosis, reliability, and security. They can contain email addresses, IP addresses, Organization addresses and identifiers, user identifiers, request details, and diagnostic messages. Diagnostic messages can contain information from queries or processed records. Logs should not be treated as a store that is guaranteed to exclude learner information or other personal data.

The managed service-log store is configured in Canada with a configured retention target of 30 days. The separate metadata backup replica is configured in Canada with a 30-day retention window. Infrastructure volume snapshots are also enabled, currently with a five-day retention setting for new snapshots; their processing locations are governed by the provider arrangements. These are retention configurations, not a promise that every copy is irreversibly erased at an exact deadline. Snapshot cycles, deletion processing, and provider operations affect when individual copies expire. Any preservation required by law or for a justified security matter is handled under the Privacy Policy and applicable data protection obligations.

Temporary processing and query data is distinct from the selected storage region and from the backup and logging stores. It is not subject to a promised per-Organization size limit and is not automatically cleared after every synchronization. Retention and deletion must be managed for this data as part of the service's data protection obligations.

Backups support operational recovery. They do not constitute a separate customer archive or guarantee restoration of a particular record or a particular recovery time. Customers should retain source information and any exports they need independently of Rowseta.

Export, deletion, and residual copies

Available dataset exports use CSV. Export availability depends on the customer's access and the functions then available. Evaluation does not guarantee continued access, continued storage, or an additional export period. Applicable return and deletion obligations under the Data Processing Agreement remain in force. Return or deletion after access ends is handled through a support-led process on request through the website contact form.

Deleting a dataset removes that dataset and its stored files through the service's deletion process. Separate billing measurement information follows its own lifecycle. Individual dataset deletion does not erase retained billing count records, which remain until Organization purge. Some measurement files are removed or replaced earlier during normal measurement processing.

Organization purge removes active Organization data, metadata, and configuration through the account-deletion process. The applicable account lifecycle and any paid-account retention period are described in the Terms and Privacy Policy. Cancellation, loss of access, and completion of deletion are distinct events.

Backups and logs expire through their separate retention processes. Necessary deletion records and narrowly limited legal, accounting, or security records may remain for their stated purposes and justified retention periods. Identifier-only technical suppression markers are kept in Canada to prevent deleted content from being restored or reintroduced after Organization purge, support-media deletion or deletion of sync error messages stored with problem reports. These markers have no automatic expiry. We periodically review whether they remain necessary for that purpose and delete them when no longer needed, subject to applicable legal requirements. Identifiers can remain personal information. After a restore, deletion suppression is reapplied for Organization purge, support media and sync error messages stored with problem reports. Providers and connected support systems can require separate cleanup processing, so deletion is not an instantaneous erasure of every copy.

For in-app reports, uploaded media follows the policy in Support and Problem Reporting. Written reports and ordinary support email correspondence have a separate retention policy. Support email is received in a Gmail mailbox operated under Google's consumer terms, without a claim of processor terms or a data processing agreement covering it. The report-media period is not a general deadline for deleting every email or support record.

Use of customer learning-platform data

Customer learning-platform data is processed for the service and authorized purposes described in the Data Processing Agreement and Privacy Policy. It is not used to train machine-learning models.

Contact

For questions about these practices or to report a security concern, use the website contact form. Include enough information for us to investigate, but do not send passwords, access tokens, or unnecessary learner data.