What we process
The answers a privacy assessment asks for. Your own deployment states most of this for itself under Admin, Compliance, which is the version to screenshot because it reflects your actual configuration.
What is held
Section titled “What is held”| Category | Examples | Where it comes from |
|---|---|---|
| People | Names, year levels, tutor groups, usernames, email addresses, student numbers, card numbers | Your SIS and directory |
| Devices | Serials, models, assignment, lifecycle fields | Your MDM, and records created here |
| Work | Submissions, tickets, notes, statuses, outcomes, costs | Created in Plugboard |
| Loans | Which device, to whom, when | Created in Plugboard |
| Money | Purchases, damage charges | Created in Plugboard |
| Staff accounts | Names, emails, roles, MFA enrolment | Created here, or SCIM |
| Audit | Who did what, when | Generated |
| Configuration | Modules, workflow, templates, encrypted connector credentials | Created in Plugboard |
Special categories
Section titled “Special categories”Plugboard does not ask for and does not hold health data, ethnicity, or anything else in a special category under GDPR and equivalents.
The one thing worth flagging: free-text notes on submissions and tickets can contain anything a staff member types. A note explaining why a family cannot pay for a repair might touch on circumstances that are sensitive.
That is a training point, not a product one, and it is why ticket.internal
exists as a separate permission.
Where it goes
Section titled “Where it goes”Only where you send it, through connectors you enable.
| Category | What leaves |
|---|---|
| MDM | Device serial numbers, models, assignment and compliance state |
| SIS | Student and staff names, year levels, identifiers and email addresses |
| Directory | Names, usernames, email addresses and group membership |
| Message content and recipient addresses | |
| SMS | Phone numbers and message content |
| Ticketing | Ticket subject, body and requester details |
| Warranty | Serial numbers |
| Repair vendor | Serial numbers, fault descriptions and contact details |
| Security | Device identifiers and application approval requests |
| CRM | Account and contact details |
| Printing | Usernames, card numbers and print balances |
| AI | Whatever you ask the assistant, to a model you host |
Stated per category rather than per connector, because the question is about the kind of data leaving, and swapping Jamf for Intune does not change the answer.
Your compliance page lists only the connectors you have actually enabled, which makes it a statement about your deployment rather than about the product.
Sub-processors
Section titled “Sub-processors”Self-hosted: there are none. Nothing leaves your infrastructure except through connectors you configured, to vendors you already have a relationship with.
Managed: the hosting provider in your region, and the services listed in your agreement. Customer data stays in the region; backups replicate within it and nowhere else.
The control plane is global and holds counts, versions and billing records only. No names, no records, no content. See the control plane.
Telemetry
Section titled “Telemetry”A deployment reports count-only usage: technician accounts, managed devices, enabled modules, version, deployment id.
No names, no records, no serials, no credentials, no content of any kind.
Self-hosted deployments can disable it entirely with
USAGE_REPORTER_DISABLED=1, and export local snapshots instead. See licence and
plan.
The AI question
Section titled “The AI question”The in-product assistant runs against a model you host through the Ollama connector. Nothing is sent to an external AI provider. Without a model configured it uses a built-in offline command engine.
That guarantee is about the assistant. It does not extend to a third-party MCP client you choose to connect, because that client hands results to whatever model it uses.
If your assessment asks, state it this way: the product sends nothing to an external AI service; connecting an external MCP client is your decision, and API keys should be scoped accordingly.
Retention and erasure
Section titled “Retention and erasure”Covered in audit and retention. Retention is configurable and erasure is a first-class operation rather than a manual database edit.
Getting data out
Section titled “Getting data out”Admin, Backups exports a portable per-tenant copy at any time, without asking anybody. See backups in the app.
Related
Section titled “Related”- Compliance answers, the version your deployment states for itself.
- Regions and data residency.
- The security model.