Privacy Policy

Last updated: DRAFT. Effective date: pending.

EPM Workbench is local-first. Your rules live as plain files in your workspace, your credentials live in VS Code’s own secret store, and calls to your Oracle EPM Pod go straight to Oracle. This policy explains the narrow set of data that does leave your machine, who processes it, why, and how to switch the optional network features off.

Who we are

EPM Workbench (“we”, “us”) publishes the EPM Workbench extension for VS Code and operates the account portal and hosted services at epmworkbench.com. For the purposes of the EU/UK GDPR, we act as the data controller for account and billing data, and as a data processor for the rule content transiently handled by the hosted Groovy language server (see below).

Data-protection / privacy contact: privacy@epmworkbench.com
Legal entity, registered address, and (where required) EU/UK representative: to be confirmed before this policy takes effect.

What stays on your machine

Rule bodies are plain .groovy / .csc files in your workspace. Nothing is hidden in a proprietary store.
Envelopes, sync state, caches, and run journals live under .epmwb/ in each Pod Folder as plain JSON and content-addressed files on your disk.
Oracle EPM credentials — Service Account passwords and OAuth refresh tokens — are stored in VS Code SecretStorage on your machine, keyed by account. They are never written into pod.json, never committed to your repository, never sent to us, and never appear in run journals or logs. A credential is resolved on your machine and used only to authenticate the request to your Pod.
Calls to your Oracle EPM Pod go directly to the Pod URL you configure. They are not proxied through any EPM Workbench service — your rules and data go from your machine straight to Oracle.

We keep no copy of your rules, data, or credentials on our infrastructure. There is no hosted tenancy.

What the extension sends over the network

Hosted Groovy language server

Groovy language intelligence connects by default to our hosted Groovy language server (wss://lsp.epmworkbench.com, hosted on Railway). When this connection is active, the following is transmitted to that server:

Open rule text (every tier). The text of Groovy rule files you open or edit is sent for transient processing — that is how completions, hovers, and diagnostics are computed. Source is processed transiently to answer language requests; we do not use it to train models and do not retain it beyond the life of the connection and short-lived operational logs.
The Pod’s rule corpus (paid tiers only). Cross-artifact Full Application Intelligence additionally sends the active Pod Folder’s full rule/template/script corpus plus App Core context — including EPM connection names, usernames, URLs, and domains (never passwords) — so the server can build workspace-wide context and expand %Template/%Script macros. The server refuses this sync for sessions without a valid Offline or Full Seat Key.
Your Seat Key (when you have entered one). The signed key travels in a connection header so the server can verify your tier. Its payload contains your organization name, tier, seat count, and expiry — nothing else.
Connection metadata inherent to any network request — notably your IP address — is observed by the server and our host.
An installation identifier. When server authentication is enabled, each connection presents a short-lived signed token whose subject is vscode.env.machineId — a stable, pseudonymous per-installation identifier that VS Code generates. It is used only to attribute connections in server-side logs and to support per-seat licensing. It is not your name or email, but because it is stable per install it may qualify as personal data under GDPR/CCPA, so we disclose it here.

Lawful basis (GDPR Art. 6(1)(f) — legitimate interests): operating and securing the language service you have chosen to use, and attributing connections for abuse-prevention and licensing. You can object by disabling the connection (below), in which case calc-script intelligence continues to work fully offline. Oracle credentials are never sent to the language server, and the first connected session shows a one-time in-product notice with these facts and a disable action.

API Reference catalog update

Once a day the extension makes an anonymous conditional GET for the API Reference (Docs tab) catalog from the LSP host. The request carries no identifiers — no account, workspace, Pod, or install ID — only an If-None-Match ETag of the catalog it already has, so an unchanged catalog returns 304 Not Modified with no body. Nothing about your rules, data, or credentials is sent.

Product telemetry

We do not currently collect usage telemetry from the extension. If we introduce telemetry in the future (a planned, opt-in-respecting sink may include the installation identifier, host name, and coarse verb events), we will update this policy, state the lawful basis, and provide a control before it ships.

How to turn network features off

Disable the hosted Groovy language server: set epmWorkbench.lsp.enabled: false in your VS Code settings. This is the supported off switch. Calc-script intelligence is pure local TypeScript and keeps working offline; only the hosted Groovy/Full Application Intelligence features stop.
Disable the daily catalog check: set epmWorkbench.apiReference.autoUpdate: false to keep the catalog bundled in the extension.

With epmWorkbench.lsp.enabled: false and apiReference.autoUpdate: false, and working entirely in Offline Mode, the extension makes no network calls of its own.

Note: earlier documentation told users to blank the epmWorkbench.lsp.url setting to disable the server. That setting was removed from the Settings UI and now survives only as a hidden, hand-editable developer override for pointing the client at a self-hosted server. Use epmWorkbench.lsp.enabled to turn the connection off.

Account and billing data

When you buy seats or start a trial, we (and our processors) handle the data needed to run your account: your email, seat assignments, and the billing details you enter with our payment processor. Payment card details are handled by Stripe and are not stored on our systems.

Sub-processors

We rely on the following processors. Oracle credentials and Pod data never reach any of them; they never leave your machine.

Sub-processor	Purpose	What it receives
Railway	Hosting for the Groovy language server and the account/licensing service	Rule source code (transient, while the LSP connection is open), IP address, installation identifier
Stripe	Subscription payments and the customer billing portal	Name, email, billing/payment details, subscription and seat quantity
Resend	Transactional email (seat keys, receipts, account notices)	Name, email address, message content

We will maintain a current sub-processor list and notify account admins of material changes. A standalone sub-processors page and a Data Processing Addendum for enterprise procurement are planned as fast-follows.

Data retention

Rule content sent to the language server: processed transiently; not stored beyond the connection, aside from short-lived operational logs (target retention to be confirmed, e.g. ≤ 30 days).
Connection/IP logs and installation identifiers: retained for abuse-prevention and licensing for a limited period (to be confirmed).
Account and billing data: retained while your account is active and for the period afterward required by tax and accounting law.

Your rights

Depending on where you live, you may have rights to access, correct, delete, port, or object to the processing of your personal data (GDPR/UK GDPR), or to know about and delete personal information and to opt out of “sale”/“sharing” (CCPA/CPRA — note we do not sell or share personal information for cross-context behavioral advertising). To exercise any right, contact privacy@epmworkbench.com. We will respond within the timeframe the applicable law requires.

Oracle non-affiliation

EPM Workbench is an independent product and is not affiliated with, endorsed by, or sponsored by Oracle. Oracle and Oracle EPM are trademarks of Oracle Corporation.