[{"data":1,"prerenderedAt":289},["ShallowReactive",2],{"docs-navigation":3,"docs-page-\u002Fen-gb\u002Ftrust\u002Fdata-governance":105,"docs-surround-\u002Fen-gb\u002Ftrust\u002Fdata-governance":284},[4],{"title":5,"path":6,"stem":7,"children":8,"page":48},"En Gb","\u002Fen-gb","en-gb",[9,53,59,65,79,89,99],{"title":10,"path":11,"stem":12,"children":13},"Architecture","\u002Fen-gb\u002Farchitecture","en-gb\u002Farchitecture\u002Findex",[14,15,19,23,27,31,35,39,49],{"title":10,"path":11,"stem":12},{"title":16,"path":17,"stem":18},"Identity","\u002Fen-gb\u002Farchitecture\u002Fidentity","en-gb\u002Farchitecture\u002F1.identity",{"title":20,"path":21,"stem":22},"Organisations","\u002Fen-gb\u002Farchitecture\u002Forganisations","en-gb\u002Farchitecture\u002F2.organisations",{"title":24,"path":25,"stem":26},"Roles","\u002Fen-gb\u002Farchitecture\u002Froles","en-gb\u002Farchitecture\u002F3.roles",{"title":28,"path":29,"stem":30},"Domains and claims","\u002Fen-gb\u002Farchitecture\u002Fdomains-and-claims","en-gb\u002Farchitecture\u002F4.domains-and-claims",{"title":32,"path":33,"stem":34},"Access","\u002Fen-gb\u002Farchitecture\u002Faccess","en-gb\u002Farchitecture\u002F5.access",{"title":36,"path":37,"stem":38},"Invitations and requests","\u002Fen-gb\u002Farchitecture\u002Finvitations-and-requests","en-gb\u002Farchitecture\u002F6.invitations-and-requests",{"title":40,"path":41,"stem":42,"children":43,"page":48},"Data model","\u002Fen-gb\u002Farchitecture\u002Fdata-model","en-gb\u002Farchitecture\u002F7.data-model",[44],{"title":45,"path":46,"stem":47},"ZoneAudit","\u002Fen-gb\u002Farchitecture\u002Fdata-model\u002Fzoneaudit","en-gb\u002Farchitecture\u002F7.data-model\u002F1.zoneaudit",false,{"title":50,"path":51,"stem":52},"Shared records","\u002Fen-gb\u002Farchitecture\u002Fshared-records","en-gb\u002Farchitecture\u002F8.shared-records",{"title":54,"path":55,"stem":56,"children":57},"Glossary","\u002Fen-gb\u002Fglossary","en-gb\u002Fglossary\u002Findex",[58],{"title":54,"path":55,"stem":56},{"title":60,"path":61,"stem":62,"children":63},"Guides","\u002Fen-gb\u002Fguides","en-gb\u002Fguides\u002Findex",[64],{"title":60,"path":61,"stem":62},{"title":66,"path":67,"stem":68,"children":69},"Products","\u002Fen-gb\u002Fproducts","en-gb\u002Fproducts\u002Findex",[70,71,75],{"title":66,"path":67,"stem":68},{"title":72,"path":73,"stem":74},"Your CobraSphere systems","\u002Fen-gb\u002Fproducts\u002Fyour-systems","en-gb\u002Fproducts\u002F1.your-systems",{"title":76,"path":77,"stem":78},"Enterprise Manager","\u002Fen-gb\u002Fproducts\u002Fenterprise-manager","en-gb\u002Fproducts\u002F2.enterprise-manager",{"title":80,"path":81,"stem":82,"children":83},"Technology","\u002Fen-gb\u002Ftechnology","en-gb\u002Ftechnology\u002Findex",[84,85],{"title":80,"path":81,"stem":82},{"title":86,"path":87,"stem":88},"Why we publish this","\u002Fen-gb\u002Ftechnology\u002Fwhy-we-publish-this","en-gb\u002Ftechnology\u002F1.why-we-publish-this",{"title":90,"path":91,"stem":92,"children":93},"Trust","\u002Fen-gb\u002Ftrust","en-gb\u002Ftrust\u002Findex",[94,95],{"title":90,"path":91,"stem":92},{"title":96,"path":97,"stem":98},"Data governance","\u002Fen-gb\u002Ftrust\u002Fdata-governance","en-gb\u002Ftrust\u002F1.data-governance",{"title":100,"path":101,"stem":102,"children":103},"Updates","\u002Fen-gb\u002Fupdates","en-gb\u002Fupdates\u002Findex",[104],{"title":100,"path":101,"stem":102},{"id":106,"title":96,"body":107,"description":275,"extension":276,"meta":277,"navTitle":278,"navigation":279,"path":97,"roleNote":279,"seo":280,"sitemap":281,"stem":98,"updated":282,"__hash__":283},"docs\u002Fen-gb\u002Ftrust\u002F1.data-governance.md",{"type":108,"value":109,"toc":265},"minimark",[110,115,144,148,152,171,175,240,243,247,250,254,262],[111,112,114],"h2",{"id":113},"who-can-see-what","Who can see what",[116,117,118,130,138],"ul",{},[119,120,121,125,126,129],"li",{},[122,123,124],"strong",{},"Inside an organisation."," A person's role in an organisation decides what they may see and change there. Each role includes every role below it. See ",[127,128,24],"a",{"href":25},".",[119,131,132,135,136,129],{},[122,133,134],{},"ZoneAudit results."," The scans and findings of a domain are seen only by the organisation that holds the verified claim on it, or by someone given an access code for one scan. See ",[127,137,45],{"href":46},[119,139,140,143],{},[122,141,142],{},"CobraSphere administrators."," An administrator holds that role on their own CobraSphere account. It is given and taken away one account at a time, and every change is logged with who it was for and the roles before and after.",[111,145,147],{"id":146},"email-cobrasphere-sends","Email CobraSphere sends",[149,150,151],"p",{},"The products send their email through one mail service, and it keeps a record of every email it sends.",[116,153,154,157,160,168],{},[119,155,156],{},"The record holds the sender, the recipients, the subject, the body, when it was sent and whether sending worked.",[119,158,159],{},"Attachments are never stored. Only their file names are kept.",[119,161,162,163,167],{},"Sign-in codes and ZoneAudit access codes are masked in the stored copy. The person receives the email as it was sent, and the record shows ",[164,165,166],"code",{},"[masked]"," in place of the code.",[119,169,170],{},"Only the Admin console, used by CobraSphere administrators, can read the record.",[111,172,174],{"id":173},"codes-and-how-long-they-work","Codes and how long they work",[176,177,178,194],"table",{},[179,180,181],"thead",{},[182,183,184,188,191],"tr",{},[185,186,187],"th",{},"Code",[185,189,190],{},"How long it works",[185,192,193],{},"What is stored",[195,196,197,209,219,229],"tbody",{},[182,198,199,203,206],{},[200,201,202],"td",{},"Sign-in code, sent by email",[200,204,205],{},"60 minutes, and stops after 5 wrong tries",[200,207,208],{},"A keyed hash, never the code",[182,210,211,214,217],{},[200,212,213],{},"Code to confirm an added email address",[200,215,216],{},"15 minutes, and stops after 5 wrong tries",[200,218,208],{},[182,220,221,224,227],{},[200,222,223],{},"Sign-in code between CobraSphere sites",[200,225,226],{},"About a minute, and works once",[200,228],{},[182,230,231,234,237],{},[200,232,233],{},"ZoneAudit access code",[200,235,236],{},"30 days unless set otherwise, 90 days at most, and can be withdrawn early",[200,238,239],{},"A hash, never the code",[149,241,242],{},"A ZoneAudit access code opens one scan of one domain. Only a hash of it is kept, so the code cannot be read back.",[111,244,246],{"id":245},"where-data-is-held","Where data is held",[149,248,249],{},"The CobraSphere products and their databases run in the UK and the EU.",[111,251,253],{"id":252},"how-long-data-is-kept","How long data is kept",[116,255,256,259],{},[119,257,258],{},"A sign-in that was started but never finished is deleted once its code has expired, by a job that runs every day.",[119,260,261],{},"The record of sent email is kept with no end date for now.",[149,263,264],{},"Other retention periods are being set and will be published here.",{"title":266,"searchDepth":267,"depth":267,"links":268},"",3,[269,271,272,273,274],{"id":113,"depth":270,"text":114},2,{"id":146,"depth":270,"text":147},{"id":173,"depth":270,"text":174},{"id":245,"depth":270,"text":246},{"id":252,"depth":270,"text":253},"Who can see what, what is recorded about the email CobraSphere sends, how long codes work, where data is held and how long it is kept.","md",{},null,true,{"title":96,"description":275},{"loc":97},"2026-11-10","sG8EVAWytiNFXXp5YzmABg1Te6exwa6_c_2nmW5gu8M",[285,287],{"title":90,"path":91,"stem":92,"description":286,"children":-1},"How CobraSphere looks after access and data.",{"title":100,"path":101,"stem":102,"description":288,"children":-1},"What changed in each CobraSphere product.",1794661171310]