Boni Secure Access Privacy Notice

Boni Secure Access is enterprise software operated by Bohni Tech Private Limited. It gives authorized people access to organization-approved private applications.

The customer organization normally decides who may use the service, which applications are available, and the applicable security and retention policy. In that setting, the customer acts as controller or Data Fiduciary and Boni processes service data under its instructions. Boni may act as controller or Data Fiduciary for its own account administration, security, support, and legal records.

The service may process an organization-issued user identifier; authentication and MFA result; device identifier; enrolled public key and status; app and operating-system version; available device-posture signals; requested named application; policy decision; IP and connection metadata; session timing, byte counts, errors, and audit events.

If you contact support, Boni also processes the contact details and troubleshooting information you provide. Do not send passwords, tokens, private keys, recovery codes, or confidential network details unless an approved secure support channel specifically requests them.

The app stores its organization configuration locally or receives it through managed app configuration. OIDC credentials are stored in the shared iOS Keychain for the app and its Network Extension.

The device signing key is created as non-exportable Secure Enclave key material. The service receives only its public key and proof signatures, not the private key.

Data is used to authenticate the user, bind and revoke devices, apply organization-owned application and posture policy, establish and terminate secure sessions, detect misuse, investigate failures, support administrators and users, and maintain security and compliance evidence.

Boni Secure Access is not an advertising or analytics product. It does not use the Apple advertising identifier, sell personal data, or track people across apps or websites for advertising.

The current iOS app does not request contacts, photos, precise location, microphone, camera, health, payment, or advertising permissions. It does not inspect or route unrelated personal device traffic.

In a managed deployment, Apple MDM policy selects which managed application flows are sent through the App Proxy. The gateway can process traffic for that approved private application as needed to deliver the connection, subject to the customer’s instructions and notices.

Service data may be available to authorized customer administrators and to infrastructure or support providers acting for Boni. It may also be disclosed where required by law or needed to protect the service, customers, or others. Boni does not sell this data.

Records are retained only for the customer agreement, security, support, audit, backup, dispute, and legal periods that apply to the deployment, then deleted or de-identified when no longer needed.

Safeguards include encrypted transport, access controls, short-lived identity sessions, device-bound proof, allowlisted applications, audit logging, revocation, secure development practices, and restricted operator access. No security control eliminates all risk.

For access, correction, deletion, or other privacy requests about an organization-managed account, contact that organization first. Boni will assist the organization as required by the agreement and applicable law.

You may also contact Boni for product privacy questions or for data Boni controls directly. Depending on applicable law, rights may include access, correction, deletion, restriction, objection, portability, consent withdrawal, and grievance review.