mirror of
https://github.com/UNITRONIX/BetterDesk.git
synced 2026-09-10 17:45:42 +00:00
UNITRONIX
65 lines
3.1 KiB
Markdown
65 lines
3.1 KiB
Markdown
# BetterDesk — Compliance Notes
|
|
|
|
> **Last Updated:** 2026-04-01
|
|
> **Disclaimer:** This document provides guidance for compliance considerations. It is not legal advice. Consult your compliance officer or legal counsel for authoritative guidance.
|
|
|
|
## GDPR (General Data Protection Regulation)
|
|
|
|
### Data Collected
|
|
|
|
| Data Category | Examples | Legal Basis | Retention |
|
|
|---------------|----------|-------------|-----------|
|
|
| Device identifiers | Device ID, hostname, platform, OS version | Legitimate interest (fleet management) | Until device deleted |
|
|
| Connection metadata | IP address, NAT type, connection timestamps | Legitimate interest (network operation) | 90 days (configurable) |
|
|
| User accounts | Username, email, password hash, role | Contract performance | Until account deleted |
|
|
| Audit logs | Login attempts, remote sessions, admin actions | Legitimate interest (security) | 180 days (configurable) |
|
|
| System metrics | CPU, memory, disk usage | Legitimate interest (monitoring) | 30 days (configurable) |
|
|
|
|
### Data Subject Rights
|
|
|
|
| Right | Implementation |
|
|
|-------|---------------|
|
|
| Right to access | Export device/user data via API (`GET /api/peers/{id}`, `GET /api/org/{id}/users/{uid}`) |
|
|
| Right to erasure | Delete device (`DELETE /api/peers/{id}`), delete user (`DELETE /api/org/{id}/users/{uid}`) |
|
|
| Right to rectification | Update device notes/tags (`PATCH /api/peers/{id}`), update user (`PUT /api/org/{id}/users/{uid}`) |
|
|
| Right to data portability | Export via API (JSON format) |
|
|
| Right to object | Organization admin can disable data collection features |
|
|
|
|
### Recommendations
|
|
- Deploy with TLS enabled for all connections
|
|
- Enable audit logging for accountability
|
|
- Configure metric retention periods per your data retention policy
|
|
- Use session recording only with informed consent (banner/notification)
|
|
- Document your processing activities if you are a data controller
|
|
|
|
## SOX (Sarbanes-Oxley)
|
|
|
|
### Relevant Controls
|
|
|
|
| Control Area | BetterDesk Feature |
|
|
|-------------|-------------------|
|
|
| Access controls | Role-based access (owner/admin/operator/user), TOTP 2FA |
|
|
| Audit trail | Comprehensive audit logging (login, sessions, config changes) |
|
|
| Segregation of duties | Operator vs admin role separation |
|
|
| Change management | Git-based version control, CI/CD pipeline |
|
|
|
|
## HIPAA (Health Insurance Portability and Accountability Act)
|
|
|
|
### Technical Safeguards
|
|
|
|
| Requirement | BetterDesk Implementation |
|
|
|-------------|--------------------------|
|
|
| Access control | Role-based authentication, per-organization isolation |
|
|
| Audit controls | Audit log with timestamps, user IDs, actions |
|
|
| Integrity controls | NaCl authenticated encryption, TLS transport |
|
|
| Transmission security | TLS on all network connections (configurable) |
|
|
| Encryption at rest | PostgreSQL encryption (deploy-time configuration) |
|
|
|
|
### Recommendations for HIPAA Deployments
|
|
- Use PostgreSQL with TLS and disk encryption
|
|
- Enable all TLS flags (`--tls-signal`, `--tls-relay`)
|
|
- Require TOTP 2FA for all operator/admin accounts
|
|
- Set session timeouts to 15 minutes or less
|
|
- Enable session recording for audit purposes
|
|
- Regular access reviews via organization user management
|