Service privacy notice
How the CNA monitoring service processes data on behalf of our customers: what it collects, why, how long it is kept, who can see it and how it is protected.
Draft v0.3 (October 2026), replacing v0.2 of 12 December 2024. This draft is for review by our legal advisers. It is not legal advice and is not yet in force. Effective date: [PLACEHOLDER: effective date].
Who is responsible
CNA (Continuous Network Assessment) is a managed digital-experience and infrastructure monitoring service provided by Rossi Networks Limited (company number 11590609), registered office Unit 36 Silk Mill Industrial Estate, Brook Street, Tring, HP23 5EF, United Kingdom, and registered with the Information Commissioner's Office under number 00015926133.
- For monitoring data, the customer is the controller and CNA is the processor. The customer decides what is monitored and why. We process the data only on its documented instructions, under the data processing terms of its contract with us: [PLACEHOLDER: link or reference to the customer DPA].
- For website visitors, enquiries and the business contacts at our customers, CNA is the controller. That is covered by the website privacy notice.
If you work for one of our customers and have a question about monitoring data that concerns you, please contact your employer first, as the controller. If you contact us, we will pass your request to the customer and help it respond.
What the service is made of
- Office sensors (ModelB, ModelC and ModelA), placed where people work. They test the customer's applications, DNS, network path and Wi-Fi.
- Server agents for Linux and Windows servers and virtual machines, and connections to the customer's cloud accounts.
- The end-user device agent, installed on the customer's laptops and desktops.
- Cloud WAN probes, which test each site's internet circuits from the cloud.
- The CNA portal, with dashboards, floor maps, alerting and an AI assistant.
- A dedicated Cloud Unit for each customer, holding its portal and databases. No data is shared between customers.
Sensors and agents send data outbound over TLS only. See Architecture.
Data we process
| Category | What it includes | Source |
|---|---|---|
| Server and cloud performance | CPU, memory, disk, network and process metrics from servers and virtual machines; container metrics; certificate expiry and endpoint availability; metadata from connected cloud accounts. | Server agents, cloud account connections |
| Office experience | Application and DNS response times, network path latency and loss, Wi-Fi connection quality, speed test results. | Office sensors, cloud WAN probes |
| Nearby Wi-Fi networks | Network names (SSIDs), access point identifiers (BSSIDs), channels, security type and signal levels of the networks a sensor or device can see, including networks that are not the customer's. | Office sensors, end-user device agent |
| Sensor locations | Each sensor's site and its position on a floor plan. | The customer, in the portal |
| End-user device data | Device name and model, operating system, logged-in user, CPU, memory and disk use, running processes, network interface statistics, public and private IP addresses, Wi-Fi connection details (signal, rates, access point), secure-access client connection details where one is used, and application response times. This can be linked to a named employee. | End-user device agent |
| Portal access data | User identifiers, IP addresses, timestamps and activity logs. | The portal |
| Configuration data | Sites, sensors, applications, Wi-Fi profiles, thresholds and alert recipients, with an audit trail of who changed what and when. | The customer, in the portal |
| Portal user details | Names and work email addresses of the customer's authorised portal users and alert recipients. | The customer |
| AI assistant questions | The questions users type into the AI assistant, and the answers it gives. | Portal users |
The service measures performance. It collects performance metrics, not logs or traces.
The service is not designed to process special category or criminal offence data.
What we use it for
Only to provide the service to the customer, on its instructions:
- monitoring and reporting the performance of the customer's network, Wi-Fi, applications, servers and devices;
- sending the alerts the customer configures, to the recipients it chooses;
- answering questions in the AI assistant;
- supporting the customer, and keeping the service secure and working.
We do not use monitoring data for our own marketing, and we do not sell it.
AI assistant
The AI assistant, available now in the portal, answers questions in plain English using the customer's own monitoring data. It helps people interpret what CNA measures. It does not make decisions about individuals, and alerts remain thresholds that the customer sets.
| Provider | Grafana Labs runs the assistant as a cloud service. Its model providers, which serve Claude models, are Anthropic, Google (Vertex AI) and Amazon Web Services (Amazon Bedrock); Grafana Labs chooses among them by region. Web searches send only the search terms, to Tavily. |
|---|---|
| Processing region | Grafana Labs' EU region: inference runs in EU/EEA infrastructure, though not limited to a particular EU country. There is no UK-only option. |
| Retention of questions and answers | Not retained by the model providers. Grafana Labs keeps the conversation history (questions, answers and metadata) for 90 days (Grafana Labs’ default), and it may remain in its systems for up to 30 days after that. |
| Use of customer data for training | None. Neither Grafana Labs nor its model providers use customer data to train AI models. |
| When data is sent | Only when a user asks the assistant something. It can see only what that user is allowed to see in the portal. |
A private AI option is coming next, for customers whose policies do not allow operational data to go to a shared AI service. It is being built on Amazon Bedrock, to run in an AWS account and region chosen for the customer: [PLACEHOLDER: who operates the private AI, once available].
How long we keep it
| Data | Kept for |
|---|---|
| Monitoring data (metrics) | 90 days by default; longer by agreement with the customer |
| Wi-Fi scan data (nearby networks) | 24 hours |
| Portal access logs | 12 months |
| Configuration audit trail | 1 year |
| AI assistant questions and answers | 90 days (Grafana Labs’ default), then up to 30 days before final deletion |
| Contract records | 7 years after the contract ends |
When the contract ends, monitoring data is [PLACEHOLDER: confirm end-of-contract handling: returned, deleted, or both, and within what period, per the DPA]. Data past its retention period is securely deleted or anonymised.
Who can see it
- The customer's authorised portal users, through role-based views. Administration and configuration views are restricted to staff the customer nominates.
- CNA staff who run and support the service, only as needed to do so. [PLACEHOLDER: confirm CNA staff access controls and whether access is logged]
- Our sub-processors, such as hosting and the AI assistant provider. They are listed on the sub-processors page.
- Alert destinations the customer chooses. Alerts go to email groups as standard. A customer can also choose to send them to its own chat, ITSM or on-call tools, such as Microsoft Teams, Slack, ServiceNow, PagerDuty or a webhook. These are optional and set up only on the customer's request. [PLACEHOLDER: confirm with legal whether customer-chosen alert destinations are the customer's own recipients rather than CNA sub-processors]
- Authorities, only where the law requires it.
Where it is hosted
Each customer's Cloud Unit is hosted on Amazon Web Services (AWS) in the United Kingdom, in a dedicated environment, unless the customer chooses to host it in its own private environment. Alert emails are sent by a mail relay that we operate ourselves.
International transfers
Monitoring data stays in the UK. The exception is the AI assistant: a question, and the data needed to answer it, are processed in Grafana Labs' EU region, in the European Economic Area. That transfer is covered by the UK's adequacy regulations for the EEA. Where data is transferred outside the UK, it is protected by one of the safeguards UK law recognises, to be confirmed for each transfer:
- UK adequacy regulations for the destination country;
- the UK–US data bridge, for US recipients certified under it;
- the International Data Transfer Agreement (IDTA), or the UK Addendum to the EU standard contractual clauses.
Security
- In transit: all data from sensors, agents and probes travels over TLS, and connections are outbound only. The portal is served over HTTPS.
- At rest: Cloud Unit storage is on encrypted AWS volumes. Storage on the office sensors is encrypted and unlocks only on the network, so a sensor taken off site cannot be read.
- Access: multi-factor authentication and single sign-on with the customer's identity provider for portal access; role-based views; optional source-IP or VPN restriction.
- Isolation: a dedicated Cloud Unit for each customer, with its own portal and databases.
- Assurance: IASME IoT Cyber Assurance Level 1, covering devices, hub, apps and associated cloud services. See Security and assurance.
- Incidents: we notify the customer without undue delay after becoming aware of a personal data breach, as the DPA sets out: [PLACEHOLDER: breach notification period in the DPA].
Automated decisions
The service makes no decisions with legal or similarly significant effects about anyone solely by automated means. Alerts report measurements against thresholds the customer sets. The AI assistant analyses monitoring data to help people understand it; it does not decide anything about individuals.
Information for customers
The end-user device agent processes data about your employees. This section is to help you with your data protection impact assessment (DPIA) and the privacy notice you give your staff. It is not legal advice, and as controller the assessment is yours.
| What is collected | Device name and model, operating system, logged-in user, CPU, memory and disk use, running processes, network interface statistics, public and private IP addresses, Wi-Fi connection details and nearby Wi-Fi networks, secure-access client connection details where one is used, and response times to the applications you choose to monitor. |
|---|---|
| What it can reveal | Which employee uses which device, when the device is switched on, and, through the public IP address and Wi-Fi details, roughly where it is connected, for example which office. |
| How often | Wi-Fi scans of nearby networks every 15–20 minutes; Wi-Fi signal every 15 seconds; CPU, memory and disk every 20–30 seconds (see Data and alerting). The agent reports only while the device is switched on. |
| How long it is kept | 90 days by default (longer by agreement); Wi-Fi scan data 24 hours. |
| Who can see it | Your authorised portal users, through role-based views. Administration views are restricted to staff you nominate. You decide who has access. |
| What it does not collect | [PLACEHOLDER: confirm what the agent does not collect, e.g. file or email content, keystrokes, screen contents, browsing history] |
Points you may want to cover in your staff notice: that the agent is installed and why; the lawful basis you rely on (often legitimate interests in running a reliable IT service); the data above and how long it is kept; who in your organisation can see it; and how staff can ask questions or exercise their rights. Office sensors and Wi-Fi scans may also record the names of nearby networks that belong to other organisations or to individuals, such as phone hotspots; these are kept for 24 hours.
Your rights
People whose data is in the service have the rights to access, rectification, erasure, restriction, portability and objection. Because the customer is the controller, requests should go to the customer. We help customers respond, as the DPA sets out.
Complaints and contact
Questions about this notice: email info@cnassess.co.uk or write to us at the registered office. Complaints about how your employer uses monitoring data go first to your employer. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.
Changes to this notice
Each version shows its number and effective date. We will notify customers of material changes by email before they take effect. This version: Draft v0.3 (October 2026), effective [PLACEHOLDER: effective date].