1. What this is
OXU Guard is OXU's internal security monitoring service. It is built to the same security standards as OXU IDP and exists solely to protect your organization.
When your organization enables OXU Guard, OXU IDP sends security-relevant activity metadata to OXU Guard so it can detect suspicious behavior, identify potential security risks, and raise security alerts for your organization's security team.
OXU Guard is not a separate company or third-party service. It is operated by OXU and is subject to the same security, privacy, and confidentiality commitments that apply to OXU services.
The short version: OXU IDP shares activity metadata, not authentication secrets. This may include what security-related action occurred, when it occurred, whether it succeeded or failed, and limited information about the actor, device, or source where available. OXU IDP never sends passwords, passkeys, MFA secrets, recovery codes, private keys, or the contents of protected credentials to OXU Guard.
OXU Guard uses this information only to assess security risk, detect suspicious behavior, correlate security events, and raise alerts.
2. When data is shared
OXU IDP shares activity data with OXU Guard only when OXU Guard Data Sharing has been enabled for your organization.
An Organization Admin can manage this setting from:
Admin Console → Settings → Security → OXU Guard
The organization can:
| Setting | What happens |
|---|---|
| Off | OXU IDP does not send activity data to OXU Guard. |
| On | New eligible security activity is sent to OXU Guard for security analysis. |
| Pause | OXU IDP stops sending new activity data. Previously shared data remains subject to the applicable retention policy. |
| Turn Off | OXU IDP stops sending new activity data and requests deletion of previously shared OXU IDP data in OXU Guard according to the deletion policy. |
Turning OXU Guard on or off does not change the user's permissions, authentication configuration, sessions, credentials, or access to OXU IDP.
3. What OXU IDP shares
When Data Sharing is enabled, OXU IDP shares security-relevant activity metadata.
The purpose is to give OXU Guard enough information to answer:
Who did what, when, from where, and did it succeed?
OXU IDP does not share the underlying authentication secret or protected credential involved in the activity.
Activity categories
| Activity | What's shared with OXU Guard |
|---|---|
| Sign-in & authentication | Sign-in attempt, authentication method/type, timestamp, and success/failure status. |
| Session activity | Session creation, refresh, expiration, revocation, and sign-out events, including status. |
| Password & credential activity | Password creation, change, reset, or credential-related security actions, including action type and status. The password itself is never shared. |
| MFA / verification | MFA enrollment, verification, removal, or security-method changes, including method type and result. MFA secrets, OTP values, recovery codes, and private authentication material are never shared. |
| Passkey / security key activity | Passkey or security-key registration, removal, verification, or related security events, including action type and status. Private keys are never shared. |
| Account recovery | Recovery request, recovery attempt, recovery-method change, and result. Recovery secrets or recovery codes are never shared. |
| User lifecycle | User creation, activation, suspension, deactivation, deletion, invitation, and related account actions. |
| Role & permission activity | Role assignment/removal, permission changes, group membership changes, and other privilege-related actions. |
| Organization security settings | Changes to authentication policies, security policies, session policies, MFA requirements, and other security-relevant organization settings. |
| SSO / Federation | Federation configuration changes, SSO-related security events, and authentication results. |
| SCIM / provisioning | User provisioning, deprovisioning, synchronization, and provisioning-related failures where security relevant. |
| API activity | Security-relevant API authentication, token/key creation or revocation, and sensitive API actions. Secret values and token contents are never shared. |
| Administrative activity | Security-sensitive administrative actions performed within the organization. |
| Audit / security configuration | Changes to audit, security monitoring, authentication, or access-control configuration that may affect the organization's security posture. |
Additional metadata
Where available and necessary for security analysis, an event may also contain:
- Organization ID
- User ID
- User email or other account identifier
- Event ID
- Event type
- Timestamp
- Success/failure result
- Source IP address
- Device identifier
- Device type
- Operating system
- Browser or application information
- Approximate location derived from network information
- Target object ID, where relevant
- Related organization, group, role, or policy identifier
- Technical metadata required to correlate related security events
The exact metadata depends on the activity type.
4. What OXU IDP does NOT share
OXU IDP never shares authentication secrets or protected security material with OXU Guard, including:
- Passwords
- Password hashes
- OTP values
- TOTP secrets
- MFA recovery codes
- Passkey private keys
- Security-key private keys
- Private cryptographic keys
- Session secrets
- Access-token secret values
- API secret values
- Recovery secrets
- Encryption keys
- User private data unrelated to security analysis
OXU IDP also does not send the content of user resources to OXU Guard.
OXU Guard receives information about an action, not the secret or protected content behind that action.
For example:
| DP event | Shared with Guard | Not shared |
|---|---|---|
| User changes password | password_changed, timestamp, result | The new password |
| User completes MFA | MFA method, timestamp, result | OTP/TOTP value or secret |
| User registers passkey | Passkey registration event, timestamp, result | Passkey private key |
| User creates API key | API-key creation event, timestamp, result | API key secret |
| Admin changes a role | Role-change event, actor, target, timestamp | Authentication secrets |
| User signs in | Sign-in event, result, IP/device metadata | Password or authentication secret |
5. How OXU Guard uses IDP data
OXU Guard uses activity data received from OXU IDP for security monitoring and risk analysis only.
Guard may use individual events or combine multiple events to identify suspicious behavior.
OXU Guard may therefore analyze patterns of activity rather than a single event in isolation.
Examples of security signals may include:
- Unusual sign-in activity
- Repeated authentication failures
- New or unexpected device activity
- Suspicious changes to authentication methods
- Privilege escalation
- Unusual administrative activity
- Multiple security-sensitive actions within a short period
- Suspicious API activity
- Abnormal activity across multiple OXU services
The resulting security alert may contain the relevant security context needed for investigation.
OXU Guard does not use IDP activity data for:
- Advertising
- Marketing
- Selling data
- Behavioral advertising
- General-purpose user profiling
- Unrelated product analytics
6. Data privacy
6.1 What data is processed
The information sent from OXU IDP to OXU Guard is primarily security activity metadata.
This means the data describes an activity rather than containing the secret or protected content associated with that activity.
For example:
Shared: "User 123 changed their MFA method at 10:32 UTC and the operation succeeded."
Not shared: The user's MFA secret, OTP, recovery code, or private key.
Depending on the event, metadata may include identifiers such as:
- User ID
- Email address
- Organization ID
- Device ID
- IP address
- Approximate location
- Event timestamp
- Action type
- Target identifier
- Success/failure result
- Technical information needed for security analysis
Some of these fields may constitute personal data under applicable privacy laws, even though they do not contain authentication secrets or user content.
OXU processes this information only to provide and operate security monitoring and related security functions.
6.2 Why OXU processes this data
The data is processed to:
- Detect suspicious activity.
- Identify potential account compromise.
- Detect abnormal privilege or administrative activity.
- Correlate security events across OXU services.
- Generate security alerts.
- Support security investigation and incident response.
- Maintain a security-monitoring record where applicable.
OXU Guard does not use this data for advertising or unrelated commercial profiling.
6.3 Who can access the data
The data is accessible only within OXU systems and by authorized personnel or systems that require access for security operations.
OXU Guard is an internal OXU security service, not an independent third-party data recipient.
Access is subject to OXU's applicable security and access-control requirements.
6.4 How long the data is retained
OXU IDP activity data received by OXU Guard is subject to the retention policy defined for OXU Guard.
The current policy distinguishes between:
| Data | Retention |
|---|---|
| Raw IDP activity metadata | Deleted after 3 months |
| Security outcomes such as rules, alerts, and generated security insights | Retained according to OXU Guard's security-record retention policy |
Raw activity data may therefore be removed while the security outcome generated from that activity remains available for security investigation, review, or audit.
If the organization Turns Off Data Sharing, OXU Guard permanently deletes the organization's shared IDP data, including retained security outcomes, subject to the applicable deletion process.
6.5 Organization control
The Organization Admin controls whether OXU IDP sends eligible activity data to OXU Guard.
Users are informed about this processing through OXU's applicable Terms of Service, Privacy Policy, and product disclosures.
Enabling OXU Guard does not give Guard access to:
- User passwords
- Private keys
- MFA secrets
- Recovery secrets
- Protected content
- Unrelated user data
It only enables the sharing of the security activity metadata described in this document.
7. Security of the integration
The IDP → Guard integration is designed as an internal security-service integration.
OXU IDP should transmit only events that are defined as eligible security events.
The integration should enforce:
- Service-to-service authentication
- Transport encryption
- Authorization between IDP and Guard
- Event schema validation
- Event integrity protection
- Replay/idempotency protection
- Access control
- Auditability of event delivery
- Failure handling and retry controls
An event that cannot be authenticated or validated should not be accepted by OXU Guard as a trusted security event.
8. Your controls
Your Organization Admin can control OXU Guard Data Sharing at any time:
| Action | Effect |
|---|---|
| Turn On | Start sharing eligible IDP security activity with Guard. |
| Pause | Stop sending new activity while preserving existing Guard data according to retention policy. |
| Turn Off | Stop sending new activity and permanently delete the organization's shared Guard data. |
Turning Data Sharing off does not delete the organization's IDP audit logs or change its IDP configuration unless separately specified by the applicable product policy.
9. Related policies
For more information, see:
- OXU Privacy Policy — information about personal data processing and data sharing.
- OXU Terms of Service — contractual terms governing use of OXU services.
- OXU Guard Integration Guide — information about how OXU Guard receives and processes security activity.
- OXU Security Documentation — information about OXU security controls.
10. Contact
For questions about the OXU IDP × OXU Guard integration or how activity data is processed, contact: