Privacy policy
What data we collect, why, where it is stored, for how long, and what your rights are — for UniSOC as a whole and for each product (SYLink-EDR, the DPI sensor, SYLink Browser).
Last updated:28 avril 2026
Introduction
UniSOC is the managed Security Operations Centre (SOC) platform operated by SYLink Technology, in operational partnership with Unitel for sovereign hosting. This policy describes how UniSOC collects, processes and protects data as part of its cybersecurity monitoring mission.
UniSOC is responsable de traitement within the meaning of the GDPR for the technical cybersecurity data collected by its sensors and agents. The data of your end users, for which you are the primary data controller, is processed by UniSOC as sous-traitant, under a data processing agreement signed with your organisation.
Hosting : all UniSOC servers are hosted in France at Unitel on certified infrastructure HDS V2 (the French health data hosting certification) and aligned with SecNumCloud. No data leaves French territory.
Data collected by UniSOC (overview)
UniSOC collects only the data strictly necessary to detect and respond to cybersecurity incidents. No personal data is ever resold, shared with third parties for commercial purposes, or used for advertising.
- • Network flow metadata (IP, port, size, duration)
- • Endpoint EDR events (process, file, registry, Windows logs)
- • Indicators of compromise (IoCs) matched
- • SHA-256 hashes and binary indicators (whether a secret is present)
- • User agent and browser fingerprint (extension)
- • The public IP and the machine's local LAN IP (extension)
- • UniSOC authentication logs (client account)
- • The content of your files (only a SHA-256 hash, when a threat is detected)
- • Passwords in clear (always hashed locally)
- • The content of your HTTPS or encrypted communications
- • The content of the web pages visited (domain only)
- • Cookies in clear (metadata only)
- • Keystrokes outside the monitored sensitive fields
- • Medical, judicial or ethnic data, and the like
Legal bases (GDPR art. 6)
- • Legitimate interest— protecting your organisation's information system against cyber threats (art. 6.1.f)
- • Performance of a contract— provision of the managed SOC service you subscribed to (art. 6.1.b)
- • Legal obligation— compliance with NIS2, the GDPR, DORA and French critical-infrastructure law where applicable (art. 6.1.c)
- • Consent— for marketing communications or account creation (art. 6.1.a)
Retention periods
| Type of data | Retention period |
|---|---|
| Security events (EDR / DPI / Browser) | 90 jours |
| Alerts triaged and archived | 12 mois |
| Qualified incidents (post-incident response) | 5 years (NIS2) |
| Portal authentication logs | 12 mois |
| User account data | Duration of the contract plus three years |
| SHA-256 IoC hashes for threat intel | Indefinite (anonymised) |
SYLink-EDR — Endpoint agent
SYLink-EDR is the detection agent installed on your organisation's Windows, Linux and macOS machines. It analyses system activity locally to detect malicious behaviour (malware, ransomware, lateral movement).
- • Process creation: name, path, SHA-256 hash, command line, parent process, user (OS account)
- • Outbound network connections: source/destination IP, port, protocol, initiating process
- • Files: path, SHA-256 hash, size, operation (created/modified/deleted) — only when a YARA or Sigma rule matches a threat
- • Windows Registry: persistence keys modified (Run, Services, Scheduled Tasks)
- • Windows Event Logs: authentication, privilege escalation, services
- • Hardware and software inventory: operating system, version, RAM, CPU, installed applications
- • Heartbeat: online/offline status, agent version, last scan
DPI sensor — passive traffic inspection
La DPI sensor (Deep Packet Inspection) is a VM deployed on your infrastructure (VMware, Proxmox, Hyper-V) that receives a copy of the traffic through aSPAN port ou Virtual TAP. It passively analyses the traffic to detect anomalies (C2 beaconing, exfiltration, scanning).
- • Flow metadata: source and destination IP, port, protocol, size, timestamp, duration
- • Unencrypted protocol headers: DNS queries, HTTP host and path (no body), TLS SNI, certificates
- • Pattern matchingon Snort / Suricata signatures (known public intrusion)
- • Statistical anomalies: abnormal outbound volume, periodic beaconing, unusual ports
- • Threat intel detections: IP and domain matching against our millions of IoCs
SYLink Browser — Browser extension
SYLink Browser is the browser extension (Firefox / Chrome / Edge) that protects against data leaks to public AI services (ChatGPT, Claude, Gemini and others), phishing, typosquatted domains and risky services. It is also distributed through the official Mozilla and Google stores, which impose their own privacy rules.
- • Shadow AI detections: the LLM domain visited, the length of the pasted text, its SHA-256 hash and binary indicators (presence of an IBAN, a card number, an AWS key, a JWT, a private key)
- • Phishing / IoC match: domain visited, IoC matched, severity, threat intel context
- • Network inventory: the top registrable domains visited and the third-party ratio (never the full URL)
- • Cookie inventory: the number of cookies per domain and their flags (third-party, secure, HTTP-only) — never their content
- • Extensions inventory: ID, name, version and permissions of installed third-party extensions (a supply-chain signal)
- • Device fingerprint: user agent, platform, language, time zone, screen resolution, the public IP seen by the server, and the private LAN IP (192.168.x.x through WebRTC STUN)
- • Sites visited (Shadow SaaS): known domains (Notion, Slack, WeTransfer and the like) — the domain only, never the full URL
Your rights (GDPR)
Right of accessRGPD art. 15
Obtain a copy of the data processed about you
Right to rectificationRGPD art. 16
Correct inaccurate data
Right to erasureRGPD art. 17
Request erasure of your data
Right to objectRGPD art. 21
Object to the processing (on legitimate grounds)
Right to data portabilityRGPD art. 20
Retrieve your data in a structured format
Right to restriction of processingRGPD art. 18
Temporarily restrict the processing
How to exercise your rights
For any request concerning your personal data, contact our Data Protection Officer:
dpo@unisoc.fr
SYLink Technologie · 35 rue Blatin · 63000 Clermont-Ferrand · France
Response time: one month at most (extendable by two months for complex requests). You may also refer the matter to the CNIL.
Technical security
- TLS 1.3 encryption on all communications
- AES-256 encryption at rest (database)
- Fernet encryption for internal secrets
- Sovereign HDS v2 hosting in France
- TOTP multi-factor authentication for the portal
- Network isolation per tenant (partitioned database)
- Full audit trail on access
- Active disaster recovery (geo-redundant nightly sync)
- Immutable 90-day backups
- Annual third-party penetration testing
Changes
This policy may be updated to reflect changes in our services or in the regulation. The date of the last update is shown at the top of this page. For substantial changes, account administrators will be notified by email at least 30 days before they take effect.
Contact us
DPO / GDPR
dpo@unisoc.fr
To exercise your rights or ask a GDPR question
Technical support
support@unisoc.fr
For any question about the agents, sensors or extension
Security (vulnerability disclosure)
security@unisoc.fr
Responsible disclosure of a vulnerability
Postal address
SYLink Technology
35 rue Blatin
63000 Clermont-Ferrand
France