Privacy policy
For FileX Eraser for Business (eraser.cybxsan.com) and its desktop application. The FileX toolkit at files.cybxsan.com has its own policy.
Last updated: 16 September 2026
The short version
- Activating a licence makes one network call: the licence key and a machine fingerprint. Air-gapped sites can activate offline instead.
- After activation, erasing transmits nothing. No telemetry, no usage counter, no phone-home.
- We never receive your file contents. There is no setting that changes this.
- When you choose to certify a job, we receive certificate metadata and archive it so it can be verified later.
- By default that metadata contains SHA-256 hashes of file paths, not filenames.
- We do not use analytics vendors, advertising networks or third-party scripts.
Who we are
CybXSan operates FileX Eraser for Business. For the account and certificate data described below we act as a data processor on behalf of your organisation, which is the controller. See the Data Processing Addendum for those terms. Contact: info@cybxsan.com.
When you activate a licence
The software checks that it is licensed, once, when you activate it. That check sends your licence key and a machine fingerprint — a derived identifier for the device, so a licence bought for five endpoints is used on five. Nothing else. No file names, no file contents, no directory listing.
Dodo Payments receives part of this. Licence keys are issued by Dodo Payments, our merchant of record, and Dodo counts how many machines each key is active on. So when you activate a key you bought online, our server passes Dodo the licence key and a short machine identifier — the first characters of the machine fingerprint, which is itself a one-way hash. Dodo receives no hostname, no username, no file name and no file contents. Licences issued directly by us (Enterprise and air-gapped sites) are never sent to Dodo.
This is a change from earlier versions, which did not check a licence at all, and we would rather state it here than let you discover it in a packet capture. Sites that cannot reach the network can activate offline by exchanging a file through the console; the software then never makes a network call of any kind.
When you erase
FileX Eraser for Business and FileX SSD Eraser collect nothing. Once activated, they make no network request while erasing — they work identically on a disconnected machine, which is the simplest way to confirm this for yourself. There is no usage counter and no record of an uncertified erasure anywhere but on your own disk.
FileX Drive Purge is the exception, because it is sold per drive. Immediately before it sanitizes a drive it asks FileX to reserve one drive from your pack, and once the sanitize is confirmed it reports that the drive was used (or hands the reservation back if it was not). Each of those requests carries the licence key, the machine fingerprint, a random job number and a SHA-256 hash of the drive's serial number — so you can audit which drives a pack was spent on — and nothing else: not the serial itself, not the model, not anything that was on the drive. If FileX cannot be reached, Drive Purge does not run. Sites licensed for air-gapped use by agreement are not counted this way.
When you certify a job
Certifying is always an explicit action. At that point we receive and store:
- The number of items, their individual sizes, and the total bytes
- The overwrite method, standard, pass count and assurance class
- Start and finish timestamps
- A machine fingerprint and hostname, so a certificate names where the work happened
- Per item, a SHA-256 digest of the path by default
We never receive file contents or file bytes. Real filenames reach us only
if an administrator of your organisation explicitly enables named mode. The
active mode is recorded inside the certificate as privacy.filenames, and the
server independently re-checks the submitted record against that mode rather than trusting
what the client declares.
Because a certificate is evidence, it is immutable once archived and is
published at a permanent public verification URL. Anyone holding the certificate identifier
can read that record. Choose hashed mode — the default — if path names would be
sensitive in that context.
Account data
Signing in to the console uses Google or Microsoft. We receive the provider's subject identifier and your verified email address, and store your name if the provider supplies it. We do not receive your password. We reject an unverified email address outright.
Session cookies are stored only as a SHA-256 digest of their value, as are organisation API tokens. Sessions expire after 30 days.
Billing data
Purchases made online are processed through Dodo Payments as merchant of record. They handle payment, tax and invoicing, and they — not we — receive your payment details. We never see or store card data. We record that a purchase occurred and what it granted.
Legal bases
| Purpose | Basis (GDPR Art. 6) |
|---|---|
| Providing the console and archiving certificates | Performance of a contract |
| Maintaining the public verification endpoint | Legitimate interests — evidence nobody can check is not evidence |
| Billing and tax records | Legal obligation |
| Security and abuse prevention | Legitimate interests |
Retention
- Certificates: retained for as long as the verification URL is to remain resolvable. That is the product — a certificate that vanishes is not evidence. Deletion on request is covered below.
- Credit ledger: append-only, and retained for the life of the organisation. A ledger that can be rewritten cannot be trusted.
- Sessions: 30 days.
- Billing records: as required by tax law.
Your rights
Access, correction, erasure, restriction, portability and objection, under the GDPR, the DPDP Act and comparable laws. Write to info@cybxsan.com.
One honest caveat on erasure: we will delete your account, your organisation's state and archived certificates on request. But if you have already handed a certificate to an auditor or a regulator, deleting our copy will make their verification link stop resolving. Tell us which outcome you want, because you may not want the second one.
International transfers
Data is processed on Cloudflare infrastructure. See Security — data residency for how to obtain the current primary region. Note that once a licence is activated, erasing without certifying transmits nothing at all and so involves no transfer — and that an offline-activated installation never transmits anything, at any point.
Changes
Material changes will be announced here with a revised date. Certificates already issued are governed by the disclosures in force when they were archived — we cannot retroactively change what a record revealed.