Privacy

Who is responsible

The data controller is Wireless Connect Ltd, a company registered in Ireland (number 416620), whose registered office is Finnoe Road, Borrisokane, Co. Tipperary. OgmaProtect is a business name of Wireless Connect Ltd. Our trading and postal address is Ogma Protect, Unit 2, Park West Centre, Park West, Dublin 12, D12 X60V, Ireland.

Data protection contact: Michael Cotter, a director, who is responsible for data protection for the company. We have not appointed a Data Protection Officer. For anything about your data, write to support@ogmaprotect.com, or by post to our trading address. Our supervisory authority is the Irish Data Protection Commission.

This website

ogmaprotect.com is a static site. It sets no cookies, embeds no trackers, loads nothing from third-party origins, and contains no JavaScript that observes you. We do not currently use any analytics; if that ever changes, it will be a cookie-less, consent-respecting measurement and this page will say so first.

The site is served through Cloudflare Pages. Like any host, Cloudflare processes connection metadata (such as your IP address and the request itself) transiently to deliver and protect the site.

When you contact us

If you email hello@ogmaprotect.com, support@ogmaprotect.com or abuse@ogmaprotect.com, or call us, we receive what you choose to send — typically your name, contact details and a description of your network or your question. We use it to answer you and to keep normal business correspondence. We do not sell it, share it for marketing, or add you to mailing lists you didn't ask for. Our mailboxes are hosted by Google Workspace.

One category of mail is not marketing and does not rest on consent: if we hold a contact for a deployment, or you own a box enrolled in the threat feed, we will send security advisories about the software it runs, on the basis of legitimate interest (GDPR Art. 6(1)(f)) — see SECURITY.md in the product for exactly how and when.

The router software

OgmaProtect runs entirely on your router. It sends no telemetry, makes no licence checks, and your configuration never leaves your hardware. The only outbound connections are the ones you configure yourself, and the premium threat feed if you turn it on (below).

One more feature can reach us, and only if you turn it on: the update check (off by default). When enabled, or when an operator presses Check now, the router fetches one small signed file from ogmaprotect.com over HTTPS and verifies it locally against the key shipped in its own package, so it can tell you whether a newer release exists. That request carries nothing about your router — no version, no hostname, no serial number — it is a plain read of a public file; like any HTTPS request, the connection itself shows our host (Cloudflare) your public IP address and a client name. Nothing is ever installed automatically.

The premium threat feed: what your box sends

The feed is a paid subscription. Your box talks to our feed service only after you enrol it with an activation key. Then it does four things, and nothing else:

• It enrols, once. It sends your activation key, a tunnel public key it made, the product name and its release series (for example 7.9). No hostname, no serial number, no interface list, no configuration. We give it a device id and a tunnel address, both ours.
• It keeps an encrypted tunnel open. A small keepalive packet lets our feed server see your box's public IP address, which it needs to reply. That address is held in the server's memory only, while the feed is on. Our feed service never logs or stores it.
• It receives the list through the tunnel, with the catalogue of categories, the list's checksums and, once a day, the details of the listed addresses. These requests say nothing about your box.
• It may re-home. If we move it to another server, or it has lost contact for a day or more, it sends a token we gave it, its tunnel public key, the product and its series, and gets its new server.

Your box never sends us your traffic, what it blocked or logged, your configuration, or anything about the devices on your network. To report an address you think is listed by mistake, email us (below); the box sends nothing when you do.

Enrolment records. When a box enrols or re-homes, our enrolment service records the IP address the request came from, the time and the result. We keep these records for 30 days, to detect abuse such as someone guessing keys. Our service logs hold the outcome and the device id, never the address.

Your devices in our records. For each box we keep its device id, when it enrolled, its release series at enrolment, its tunnel public key and tunnel address, its state, and roughly when we last heard from it (to the hour). Never its IP address. We use these to run the feed, and for one other purpose only: product security advisories to your account's owners.

The customer portal

You buy the feed and manage your keys and boxes at portal.ogmaprotect.com. You sign in with your email address and a passkey, or a password, with an authenticator code, which is required before you can buy or see keys. We do not use Google or any other outside sign-in for customers.

• Your account: your email address, your organisation's name and country, its VAT number if you give one at checkout, the members and their roles, pending invitations, and the labels you give your keys. If a colleague invited you, we got your email address from them.
• Sign-in factors: a password's hash (Argon2id), passkeys' public keys, the one-time-code secret, and hashed recovery codes. We never hold a password itself.
• Activation keys: stored encrypted, and shown only in the portal to the people your organisation allows. We never email a key.
• Activity log: a record of actions in the account (for example a key revealed or a box released), which names people by an internal id only.
• Web server logs: each request's source IP address, kept 30 days, for security. Never query strings, tokens or the page you came from.

You need an email address and a way to sign in to have an account, and a billing address to buy; without them we cannot provide the service.

Cookies

This website sets none. The portal sets two, both strictly necessary, so they need no consent: __Host-session keeps you signed in (it ends after 30 minutes idle, or 12 hours at most), and __Host-csrf protects forms against forgery and lasts a year. Neither tracks you. No analytics, advertising or tracking cookies, anywhere. If Cloudflare's protection challenges a visit to the portal, it may set its own short-lived security cookie to remember that you passed. Stripe's payment page is Stripe's, under its own cookie notice.

Buying, and payments

• You pay on a page run by Stripe. Your card details go straight to Stripe. We never see your card number.
• Stripe gives us, and keeps for us: your name or your organisation's, your billing address, your email address, any VAT number, and your subscriptions, invoices, payments and refunds. Stripe also checks a VAT number with the EU's VIES service.
• We keep a copy of the billing events Stripe sends us for 6 years, as Irish tax law requires, even after you delete your account.
• Stripe also uses some of this data for its own purposes as a separate controller, such as preventing fraud and meeting its legal duties, under its own privacy notice.

Email we send

The portal sends account messages (email verification codes, password resets, invitations, and notices when your address, password or sign-in factors change), service messages (keys ready, a box enrolled, a key revealed or changed, a box released, renewal reminders and renewals, failed payments, cancellations, a subscription ending) and product security advisories. We send no marketing, and our mail has no tracking pixels or rewritten links. Stripe sends your receipts. If an address bounces or complains, we keep only a SHA-256 hash of it, so that we stop sending to it.

The threat list: addresses that attack networks

This part is for people who are not our customers: people whose IP address may be on the list.

• What we collect. IP addresses and address ranges that attacked our own networks and services: scanning our unused addresses, guessing logins on our own services, and abuse against them that our abuse desk has confirmed. The list's categories are persistent scanning, low-rate scanning, login guessing, web exploit attempts, confirmed abuse, botnet control servers, spam relays and flood (denial-of-service) sources. For each address, what kind of activity it was, when it was last seen, how often, and which ports. We do not collect the content of any traffic, web addresses visited, usernames, passwords, or anything else about the person using the address. An IP address can sometimes be linked to a person, so we treat these addresses as personal data.
• Where it comes from. Today, only our own networks and services, including reports made to our abuse desk about them, which a person confirms before use. If we add another source, this notice will say so first. We receive nothing from our customers' boxes.
• Why, and our legal basis. To protect networks and information systems from attack: ours and our customers'. Our legal basis is our legitimate interests, and our customers', in network and information security (GDPR Art. 6(1)(f), and recital 49). We have weighed those interests against the rights of the people who use these addresses, and use the safeguards below.
• How we decide. Listing is automatic: an address is listed only when its evidence passes a threshold for its kind of activity, and the evidence fades, so a listing ends by itself soon after the activity stops, usually within 1 to 14 days by category. For milder kinds of activity, boxes only log the traffic unless their owner chooses to block it. Addresses seen in floods may be forged, so that category only logs. We never list our own infrastructure, or certain shared services, and we never widen a listing to neighbouring addresses. Some listings are ranges of up to 1,024 addresses (a /22), as a source reports them; wider ranges wait for a person's approval. A listing records observed network activity. It is not a finding that anyone committed an offence, and we never try to identify who uses an address. A listing has no legal effect on you: each customer decides on their own box what to do with it, and any listing can be reviewed by a person on request.
• Who receives it. Our customers' enrolled boxes, wherever they are, each through its own encrypted tunnel. Each entry carries the address, its category, a confidence level, when it was first seen and a reference number, and never says where the information came from. We do not sell the list or publish it. A box whose subscription has ended may keep using its last copy until its owner turns the feed off; our updates, including removals, no longer reach it.

If you think your address is listed by mistake

Email abuse@ogmaprotect.com with the address, the reference number if a box or website showed you one, and why you think it is wrong. A person checks it, normally within two Irish working days. If it should not be listed, we remove it. A removal reaches every subscribed box with its next updates, usually within half an hour, and we normally keep the address off the list for 90 days. This is also how you object to our use of your address (GDPR Art. 21): we take it off the list while we look at it, unless it is still attacking networks, and keep it off unless we have compelling legitimate grounds. Because many people can share an address, we may ask you to show that you use it, for example by writing from that network's abuse contact. We use your email only to handle your report.

Why we use data, and our legal bases

Who receives data from us

The portal, its databases, the enrolment and feed services and our backups run on our own servers, in our own datacentres in Ireland. We use these providers, each under a contract that protects your data:

Our monitoring services (healthchecks.io and Pushover) receive only our own system labels and summaries, never your data. Our customers' boxes receive the threat list (above). We may also disclose data where the law requires it, for example to the Revenue Commissioners or to a court.

Transfers outside the European Economic Area

• Our providers. Stripe, Cloudflare, Amazon Web Services and Google may process data in the United States or elsewhere. Where they do, we rely on the EU–US Data Privacy Framework for providers certified under it, and otherwise on the European Commission's standard contractual clauses in our contracts with them.
• The threat list. A customer's box may be outside the EEA. Where it is in a country without an EU adequacy decision, the customer receives the list under the European Commission's standard contractual clauses (controller to controller, Module One), which our terms make part of every subscription, and may use it only for network security.
• To ask for a copy of the safeguards, write to us.

How long we keep data

Export and deletion. An owner can export the account's data as one file, and delete the account, in the portal. Deleting it cancels every subscription, releases every box, retires every key and erases the account's personal data. Billing events, and records with no link to a person, stay for the periods above, and deleted data leaves our backups as they expire.

Your rights

Under the GDPR you can ask what personal data we hold about you and get a copy, have it corrected, have it deleted, have its use restricted, take it with you, and object to any use that rests on our legitimate interests, including the threat list, enrolment records and security advisories. Write to support@ogmaprotect.com — no forms, no friction. For the threat list, use abuse@ogmaprotect.com (above). We answer within one month. We may ask you to confirm who you are, or, for an IP address, that you use it.

You can also complain to the Irish Data Protection Commission (dataprotection.ie), or to the authority where you live or work, if you believe we've handled your data badly.

Changes to this notice

We change this page when what we do changes, and say so first: for example, before we add a new source to the threat list or a new provider. The date at the top says when it last changed. If a change matters to customers, we also email the account's owners.