Data Collection, Security, and Access Revocation

What Data is Collected

Why This Data is Collected

• Username: Associates the connection with your Sophos Central account for audit, support, and access control.

• Password: Used to authenticate all API requests made to Sophos Central on behalf of COMPASS — your password is never stored in plaintext after initial entry.

How Data is Secured

• Encryption at Rest: All credentials are encrypted using AES-256 in isolated, tenant-specific databases.

• Encryption in Transit: All communications use HTTPS/TLS 1.2+.

• Access Control: Only automated systems (not staff) can use your credentials for authorized operations.

• Audit Logging: Every access, refresh, and revocation is logged for compliance.

• Multi-Tenant Isolation: Your data is never mixed with other organizations.

How to Revoke Access

Option 1: From COMPASS

1. Go to Integrations → Configurations

2. Click Sophos under the Original Equipment Manufacturers (OEMs) page.

3. Under Actions column, click Delete.

Option 2: From Sophos Central

4. Go to Sophos Central (https://central.sophos.com/)

5. Navigate to My Account → API Credentials.

6. Locate the credentials used for COMPASS and click Revoke or Delete.

What Happens After Revocation?

• COMPASS deletes all stored credentials and stops all access.

• Scheduled operations are cancelled.

You can reconnect anytime.