Privacy Policy

This policy explains what personal information Triton Agency, LLC, doing business as TeamsMFA ("TeamsMFA," "we," "us," "our"), collects through teamsmfa.com and the TeamsMFA application, including dedicated tenants at <name>.teamsmfa.com (together, the "Service"), and what we do with it. It covers visitors to our website and people who use the Service, whether they signed up themselves or were invited to a team.

1. What we collect

Account information

Your email address, which is also how you sign in, and the name you enter when you set up your account. We don't use passwords. You sign in with a one-time link sent to your email address, and optionally with a passkey.

Teams and invitations

The names of teams you create, who belongs to each team, each member's role (owner or viewer) and who invited them. When a team owner invites someone, we store that person's email address and send them an invitation, even if they don't have an account yet.

MFA secrets

For each code your team adds, we store the label, issuer and account name you give it, the code settings (algorithm, digits, period), and the secret key (the "seed"). The seed is encrypted before it's written to our database. It's decrypted only briefly, in memory, to calculate a code when a team member asks for one, and it's never sent to your browser. See Security & Trust for the details.

Passkeys

If you add a passkey, we store its public key, the name you give it, a usage counter and when it was last used. Your fingerprint, face or device PIN never leaves your device, and we never receive them.

Sign-in and security records

When you request a sign-in link, we record your email address, your IP address and the time. When you sign in, we record a session (stored as a hash, not the session itself), your IP address, your browser's user-agent string and when the session expires. We also count requests by IP address and email address to slow down abuse.

Audit log

Actions on a team are recorded in its audit log: who did it, what they did (for example, revealing a code, adding a member or deleting a secret), what it affected, the IP address and the time.

Messages you send us

If you email support or report a security issue, we keep that correspondence so we can help you.

Website visits

Our hosting provider, Cloudflare, processes IP addresses, request logs and similar technical data to deliver and protect the website and the Service. We don't run analytics or advertising scripts.

We don't collect more than we need to run the Service, and we don't buy personal information about you from data brokers.

2. How we use it

We use this information to create and run your account and teams; sign you in and keep your session secure; calculate codes for team members; send sign-in links, invitations and other service email; show owners their team's audit log; respond when you contact us; investigate abuse and security incidents; and meet our legal obligations.

We don't use your data to train AI models, we don't show you ads, and we don't sell personal information.

3. What your team can see

TeamsMFA is built for sharing, so some of your information is visible to the people you share with:

• Members of a team can see the team's other members, their roles, and the codes the team holds.
• Team owners can see the team's audit log, which includes members' email addresses, their actions and the IP addresses those actions came from.
• If you join a dedicated tenant run for your employer or another organization, that organization's administrators control the tenant and may have access to its data under their agreement with us.

4. Who we share it with

We share personal information only as needed to run the Service:

• Cloudflare, Inc. hosts the application and its database, and delivers sign-in and invitation email.
• Triton Agency, LLC, our parent company, runs the mail server for our published addresses, such as support@teamsmfa.com.
• Legal requirements. We may disclose information if the law, a subpoena or another legal process requires it, or to protect the rights, property or safety of TeamsMFA, our customers or the public.
• Business transfers. If TeamsMFA is acquired or merged, or sells substantially all of its assets, personal information may transfer to the new owner, subject to this policy or a successor policy we tell you about.

Our current list of subprocessors is on the Security & Trust page. We don't share personal information with third parties for their own marketing.

5. Cookies

We set one essential, first-party cookie, __Host-tmfa_session, when you sign in. It keeps you signed in for up to 14 days or until you sign out. It isn't used for advertising or for tracking you across other sites. We don't currently respond to "Do Not Track" browser signals, because there's no agreed standard for how websites should interpret them.

6. How long we keep it

• Account, team and secret data is kept while your account is active.
• Deleted secrets and teams are removed from our database immediately. Database backups and point-in-time recovery copies age out on Cloudflare's schedule, which is currently no more than 30 days.
• Sessions expire after 14 days, and expired sessions are cleared when you next sign in. Signing out deletes your session.
• Sign-in link records and audit log entries are kept for security and accountability, including after a team is deleted, so we can investigate misuse.
• Email you send us is kept for as long as we need it to support you.

You can ask us to delete your account at any time (see Section 8).

7. Security

All connections use TLS. MFA seeds are encrypted with AES-256-GCM using a separate key for each team. Sign-in links and sessions are stored only as hashes, and access to customer data is limited to what our systems and staff need to do their jobs. The Security & Trust page explains how this works and how to report a vulnerability. No system is perfectly secure, but we work to reduce the risk, and if a breach affects you we'll notify you as the law requires.

8. Your choices and rights

You can update your name in the app. Team owners can remove members, delete codes and delete teams there too. To get a copy of your personal information, correct it, or have your account deleted, email privacy@teamsmfa.com. We'll respond within a reasonable time, generally within 30 days, and we may need to confirm that the request really came from you.

If a law that applies to you gives you more rights, such as the EU or UK General Data Protection Regulation or a U.S. state privacy law like the California Consumer Privacy Act, we'll honor those rights for the information that law covers. Because we don't sell personal information, there's no sale to opt out of.

If you were invited to a dedicated tenant run by your organization, some requests may need to go through that organization's administrator.

9. Children

The Service is for business use by adults. We don't knowingly collect personal information from anyone under 18. If you believe a minor has given us information, email privacy@teamsmfa.com and we'll delete it.

10. International use

We're based in the United States, and the Service runs on Cloudflare's global network, with data stored in Cloudflare's database service. If you use the Service from outside the United States, your information will be transferred to and processed in the United States and other countries, whose data-protection laws may differ from your own.

11. Changes to this policy

We may update this policy as the Service or the law changes. When we do, we'll change the "Last updated" date at the top. For significant changes, we'll take reasonable steps to tell active users, such as an email or a notice in the app.

12. Contact us