Legal
Privacy Policy
Bifrost apps and service · Effective 8 November 2026. Bifrost is built so that as little as possible leaves your device, and nothing is sold or used for advertising.
Who is responsible for your data
Bifrost runs on a server operated by your organization (your employer or the company that invited you). That organization decides how Bifrost is set up and is responsible for the data on its server. Where Codefin Co., Ltd. operates the server for an organization, Codefin handles that data on the organization's behalf.
What the apps never do
- No advertising, no tracking across apps or websites, no analytics or third-party data SDKs.
- No selling or renting of personal data, ever.
- The content of your traffic is encrypted end to end between your devices and is not inspected or recorded by Bifrost.
- Terminal sessions and files you send with Bifrost Drop go directly between devices. Their contents are not stored on the server.
What the service uses, and why
| Account | Your name and email address, how you sign in (password, two-factor authentication or your organization's single sign-on). Used to sign you in and show who owns which device. |
|---|---|
| Devices | Device name, operating system and version, Bifrost version and the device's public key. Used to connect your devices and keep them up to date. |
| Connection details | The device's Bifrost address, its network addresses (including its public IP address) and the approximate country it connects from. Used to connect devices directly to each other, and for location rules your organization sets. |
| Device security checks | Only if your organization uses them: operating system version, serial number, whether certain security software is running or a company certificate is installed, and whether the device key is protected by hardware. Used to decide whether a device may reach company resources. |
| Activity log | Sign-ins, device and settings changes, remote shell requests and sessions (who, which device, when, not what was typed). Used for security and auditing by your organization. |
| Connection records | Only if your organization turns them on: which Bifrost address connected to which, on which port, how much data and when. Kept for 7 days by default (90 at most). |
| If your organization sets up email: invitations, password resets and security notices are sent through its mail provider. |
How long data is kept
Account and device information is kept while the account or device exists and is removed when your organization removes it. Logs are kept for the period your organization sets.
Sharing
Data is shared only with the organization that operates your Bifrost server, and with service providers it uses to run that server (for example hosting and email), under its instructions. It is never shared for advertising or sold.
Security
Connections use WireGuard® with an added post-quantum key exchange (ML-KEM-1024). Device keys are created on the device and never leave it. Access to the console requires two-factor authentication for administrators.
Your rights
You can ask to see, correct or delete your personal data, or object to its use, under applicable law including Thailand's Personal Data Protection Act (PDPA). Contact your organization's IT team, or write to us at support@codefin.io and we'll help or pass your request on.
Children
Bifrost is a business tool and isn't intended for children.
Changes
We'll update this page when the policy changes and show the new effective date above.
Contact
Codefin Co., Ltd. · support@codefin.io