Privacy Policy

Version 2026-10-18

Cloudraw is a secure-access service: it lets an organization's people reach the organization's work apps from approved devices and from the browser. Cloudraw is provided by DREAM VPS LTD ("Cloudraw", "we"). This policy explains what we process, why, and the choices you have.

1. Who is responsible

Cloudraw is used by organizations ("customers"). For the data of a customer's users, the customer is the controller and Cloudraw processes it on the customer's behalf and instructions. For the account data of the people who administer a Cloudraw workspace, and for our own billing and support, Cloudraw is the controller.

2. What we process

• Account data: name, work e-mail address, and, where the organization enables SMS sign-in codes, a mobile phone number.
• Sign-in data: the identity provider the organization connects (for example Microsoft 365, Google Workspace or Active Directory), the sign-in identifier it returns, and sign-in times. We do not receive or store your identity-provider password.
• Device data: for devices enrolled with the Cloudraw Connect app: device name, operating system and version, and the security checks the organization requires (for example disk encryption, firewall and screen lock).
• Access records: which app was used, when and for how long, from which device or browser, the network address it came from, and, inside the organization's network, the destination address and port and the amount of data transferred.
• Audit log: sign-ins, app launches (with the network address) and administrative changes.
• Approximate location: the city and country derived from a device's network address, to show administrators where connections come from.
• Program information: where the organization uses the app firewall, the name and path of the program on a device that opened a connection to a protected app.
• Session recordings: only for apps where the organization turns recording on. Recorded sessions show a notice before they start.
• AI assistant: where the organization uses Cloudraw's policy assistant, the administrator's questions and the workspace configuration needed to answer them, which can include people's names. Passwords and other secrets are never sent to it.
• Support and billing data: what you send us when you contact support, and the customer's billing details.

We do not use customer data for advertising, and we do not sell it.

3. Why we process it

To provide and secure the service: to sign people in, check that a device meets the organization's rules, connect people to the apps they are allowed to use, keep the audit trail the organization relies on, send sign-in codes and security alerts, provide support, and meet legal obligations.

4. Google and Microsoft sign-in

When an organization connects Google Workspace or Microsoft 365, Cloudraw asks only for basic sign-in information (your name, e-mail address and a stable account identifier) so that you can sign in with your work account. Cloudraw's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not read your e-mail, files or calendar.

5. Cloudraw Connect for Android (VPN)

Cloudraw Connect uses Android's VpnService to carry only the traffic bound for the apps and networks your organization has published to you. It is a split tunnel: only traffic for Cloudraw's private address range goes through the VPN, and there is no default route, so all other traffic leaves the device normally. The app does not log, store or send the content of your traffic or your general web browsing. It resolves only your organization's published names through Cloudraw's private DNS.

For security, the app sends a device health report to your organization's Cloudraw service. The report contains: the Android version and its security patch date; the device model; the app version; whether the disk is encrypted; whether a screen lock is set and how soon it locks; whether the device is managed (MDM, work profile, organization-owned); whether developer options, USB debugging or installing from unknown sources are on; and a check for signs of rooting or tampering. Cloudraw keeps only the latest report for each device, together with the device's latest public IP address, and deletes both as soon as the device is removed. Your organization's admins can see them.

The name you give the device when you enroll it is kept while the device is enrolled, and your organization's admins can see it. Choose a name that does not contain personal details you do not want shown.

A record of your connections to your organization's apps (which app, when and for how long) is kept for up to 30 days.

Cloudraw's security audit log records when a device is enrolled or removed, and a short note of each health report (whether it met your organization's rules and which checks changed, not the report's values). These records carry the device's identifier, are kept for 400 days, and are not deleted when the device is removed.

The app never reads or sends your IMEI, serial number, Android ID, phone number, accounts, list of installed apps, Wi-Fi names or location, and the app itself does not collect or report IP addresses. The Cloudraw service stores the latest public IP address of each device for your organization's administrators, and your organization may see an approximate location derived from that IP address. This approximate location is only the city and country associated with that public IP address; it is coarse and can be wrong, and it is not GPS, Wi-Fi or other location from your device. It is kept with the device record, latest only, and deleted when the device is removed. Your enrollment identity and keys stay in the Android Keystore (hardware-backed where your device supports it).

To deliver sign-in approval requests, the app registers with Google Firebase Cloud Messaging, which gives the device a push token; Google processes it only to deliver these notifications. The camera is used only to scan your organization's enrolment code; no image is stored or sent.

In the terms of Google Play's data safety section, the app collects these data types:

• Name and Email address: your account details from sign-in (section 2, account data);
• User IDs: your account's identifier from sign-in (section 2, sign-in data);
• Approximate location: the city and country derived from the device's latest public IP address, as described above;
• Other app performance data: the device health report described above;
• App interactions: the record of your connections to your organization's apps, kept for up to 30 days;
• Device or other IDs: the device's enrollment identifier and the push token.

Session recordings, where your organization turns recording on for an app, are kept for 90 days by default, or as the organization sets. Cloudraw does not use this data for advertising or sell it. The VPN starts only after you sign in and accept the system VPN prompt, and you can turn it off at any time in the app or in Android settings.

6. Who we share it with

Only with service providers that help us run Cloudraw, under contracts that require them to protect it:

• Cloudflare: network delivery and protection of our web addresses;
• SMS providers (InforU in Israel; ClickSend, Australia, for numbers outside Israel): only to deliver sign-in codes, when the organization enables SMS;
• IPinfo (United States): to derive the approximate location of a network address;
• Google (Firebase Cloud Messaging, United States): only to deliver sign-in approval notifications to the Android app;
• Anthropic (United States), through DREAM VPS's AI gateway: the AI model behind the policy assistant, only when the organization uses the assistant;
• the identity provider your organization chose (for example Microsoft or Google): to sign you in.

We may disclose data when the law requires it. Your organization's administrators can see the data described in section 2 for their workspace.

7. Where it is stored

Cloudraw runs on servers operated by DREAM VPS in Israel, where its backups are also kept; a standby site in the Netherlands (European Union) is being added. Some providers listed in section 6 are outside Israel and the EU; transfers to them are made under appropriate safeguards. Data is encrypted in transit, and stored credentials and other secrets are encrypted at rest. Session recordings are protected by access controls and time-limited playback links; encryption of recordings at rest is being rolled out.

8. How long we keep it

• Access history: 30 days.
• Session recordings: 90 days by default, or as the organization sets.
• Audit log (including sign-ins and app launches): kept as a tamper-evident record while the service is provided. It cannot be edited, so that it remains trustworthy evidence for the organization.
• Approximate location: kept with the device record.
• Account data: until the organization removes the person or closes its workspace. After that, we delete or anonymise it on request, except the audit log and records we must keep by law.

9. Your choices and rights

If your organization gave you access to Cloudraw, contact your organization's IT team first: they control your account and can access, correct or delete your data. You can also contact us, and where the law gives you rights (for example under the GDPR or the Israeli Privacy Protection Law) to access, correct, delete or restrict your data, or to object, we will help you exercise them, together with your organization where it is the controller.

10. Security

Cloudraw is built on a zero-trust model: apps are not exposed to the internet, every connection is checked against the organization's rules, and administrative actions are recorded in a tamper-evident audit log. No system is perfectly secure; if a breach affects your data, we will notify the organization, and you where required, without undue delay.

11. Changes

We may update this policy. We will post the new version here with a new date, and tell customers in advance about material changes.

12. Contact

DREAM VPS LTD, Israel. Privacy questions: privacy@cloudraw.com.