The short version
- Our apps do not use an Integrators Resource account, and we do not receive, store or sell your calls, mail, contacts or projects. An account with us is only for downloading our software and managing your organization (see Your account).
- Each app works only with the services you choose: Onyx Softphone with your organization's Onyx Voice phone system, Obsidian Mail with your own mail services. MORF contacts our license server only to activate, check and deactivate its license, and we keep a record of the PCs each license is used on.
- Our apps have no ads, no analytics, no crash reporting and no tracking.
- Passwords and sign-ins are kept in the device's own protected storage.
Onyx Softphone
Onyx Softphone for Windows and Android lets you use the Onyx Voice phone system your organization provides. Your organization runs that phone system and decides what it records and keeps; its own policies apply to it.
What the app keeps on your device
- Your sign-in: the server address, your email address, and your password and session. The password and session are sealed by the Android Keystore or by Windows data protection for your Windows account, never stored in plain text.
- Your call history and settings, and on Windows any contacts you save in the app.
- A short diagnostic log on the device (connection results and errors). It leaves the device only if you choose to share it with us or your administrator.
Where the app connects, and why
- Your organization's Onyx Voice server, to sign in, register your extension, place and receive calls, and show voicemail, call history and the company directory. The connection uses TLS, and call audio is encrypted with SRTP.
- A STUN server, only if your organization's phone system is set up to use one. During a call the app asks it for your public network address so the audio can find a route; that server sees your network address.
- Update checks, only in copies installed from a direct download: the app asks obsidiansuite.net whether a newer, signed version exists. That web server sees your network address and the app's version, like any website visit. Copies installed from an app store are updated by the store instead.
Permissions (Android)
- Microphone: to carry your voice during calls. It is used only while you are in a call.
- Phone calls (manage own calls): so calls work with Android's own call handling, for audio routing and to show incoming calls.
- Notifications and full-screen alerts: to show incoming calls, including over the lock screen, and missed calls.
- Contacts (optional): to show names on calls and to search your phone's contacts when you dial. Your contacts are read on the phone and are never uploaded. The app works without this permission.
- Run in the background, start at boot, exact alarms, wake lock and battery optimization exemption: to stay connected to your phone system so calls can ring while the app is closed.
- Install updates (direct-download copies only): to hand a downloaded, verified update to Android's installer, which asks you first.
- Internet and network state: to reach your phone system.
On Windows, the app can register itself for tel:, callto: and sip: links if you choose it for those links in Windows settings.
The app does not use your location or camera. It does not record calls; if your organization's phone system records calls, it does so on the server, under your organization's policies.
Obsidian Mail
This covers Obsidian Mail for Android, Obsidian Mail for iPhone and Obsidian Mail Client for Windows. Your mail, calendar, contacts and tasks go only between your device and the mail services you add, such as Outlook.com, Microsoft 365, Gmail, your organization's Exchange server or another IMAP provider.
What the app keeps on your device
- To show your mail quickly and work offline, the app keeps a copy of the messages, attachments, folders, calendar events, contacts and tasks it downloads, plus your settings and your junk filter's training and lists. This copy is encrypted (AES-256, using SQLCipher) with a key protected by your device: the Android Keystore, the iPhone Keychain, or Windows data protection.
- Your account passwords and sign-in tokens are kept in the same protected store.
- On Android and iPhone this data is excluded from cloud and computer backups.
- A short diagnostic log (connection results and errors, never message contents or passwords). It leaves the device only if you choose to share it.
Where the app connects, and why
- Your mail services, to sync and send your mail, calendar, contacts and tasks (IMAP, SMTP, Exchange ActiveSync, or Microsoft Graph for Outlook.com and Microsoft 365 calendars, contacts and tasks once you connect them). For Microsoft accounts the app signs in through Microsoft's own page in your browser and never sees your Microsoft password.
- Microsoft's account lookup (Autodiscover), only while you add an account: the address you type is sent there to find out whether it is a Microsoft 365 or Exchange mailbox.
- Pictures in messages, only when you choose to show them. The sender's servers can then see your network address and that you opened the message. Tracking pixels are blocked even then.
- Update checks, only in copies installed from a direct download (Android from obsidiansuite.net, and the Windows app): the app checks obsidiansuite.net for a newer, signed version. That web server sees your network address and the app's version. Store copies are updated by the store.
- Windows only: the Windows app looks up the published brand logos (BIMI) of verified senders through DNS, and downloads the public list of breached websites from Have I Been Pwned for its "Your Accounts" view; your addresses are not sent. If your organization uses Obsidian Suite secure links, a message you choose to send that way is encrypted and uploaded to your organization's Obsidian Suite portal, where its recipients open it.
Permissions
- Internet and network state: to reach your mail services.
- Notifications: to tell you about new mail. You can turn them off.
- Background refresh: to check for new mail while the app is closed.
- Install updates (direct-download Android copies only): to hand a verified update to Android's installer, which asks you first.
The app does not use your location, camera, microphone, phone contacts or device calendar.
Removing an account in the app deletes its data from the device, together with its password and sign-in. Uninstalling the app deletes everything it kept. Your mail on your mail service is not affected.
MORF
MORF for Windows does its work entirely on your computer. Its only connection is to our license server, integratorsresource.com, for the license itself; your projects, pictures and settings never leave the PC.
Licensing
- What MORF sends when it activates, checks or deactivates a license: the license key, a machine code for the PC (calculated from the identifier Windows gives the installation; it cannot be turned back into that identifier), the computer's name and the MORF version. Our server also sees your network address.
- When: once when you activate a PC, when MORF starts (a quiet check that the license is still valid, only if the PC is online), and when you deactivate the PC. A PC without internet can be activated with a request code on our activation page instead; that page receives the same details.
- Email: we send the license key and your download link to the email address the license is issued to, from [email protected]. We send nothing else to that address unless you write to us.
- What we keep: each license's key, the customer name and email address it was issued to, and for each PC its machine code, computer name, MORF version, network address and the times it was activated and last checked, plus a history of activations and downloads. We use this only to run the licensing (for example to free a PC's place on a license) and to support you. It is kept while the license exists; backup copies are replaced within about two months. Ask us and we will delete it.
- On the PC the license is a small signed file in the Windows ProgramData folder. Uninstalling MORF leaves it there unless you deactivate the PC.
On your computer
- Projects are saved as .morf files where you choose.
- Settings, including the edit password, are stored in your Windows user profile. The password is stored only as a salted hash (PBKDF2-SHA256), never in readable form.
- Camera calibration (optional) uses a webcam you select. The pictures it takes are processed on your computer, and a copy of the calibration pictures and results is saved in a MORF folder in your Windows temporary files so a problem can be diagnosed. Nothing is uploaded. You can delete that folder at any time.
- Start at sign-in (optional) adds a shortcut to your Windows Startup folder, which you can remove in MORF or in Windows.
This website
- integratorsresource.com uses no analytics and loads nothing from other websites. It sets a cookie only when you sign in (to your account, or our staff pages), to keep you signed in; it ends when you sign out or close the browser.
- Like any web server, ours records each request (your network address, the page, the time and your browser's description) in its logs, which we use only to run and protect the site.
- The site is delivered through Cloudflare, which processes requests on our behalf to protect and speed up the site.
- If you use the support form, what you enter (and your network address and browser description) is saved on our server and emailed to our support inbox so we can answer you. We keep it only to handle your request and follow up on it. Ask us and we will delete it.
- MORF customers get a personal download link. Each download is recorded with the license (time, network address and browser description). The offline activation page handles the request code you paste or upload as described under MORF; neither page sets a cookie.
- The license management pages are for our staff only. They use a sign-in cookie, set only for staff who sign in there.
Your Integrators Resource account
You need an account to download our software from integratorsresource.com, obsidiansuite.net and onyxvoice.net, and to manage your organization.
- We store your name, email address and the name of your organization, a one-way hash of your password (never the password itself) and, if you turn on two-step sign-in, the key your authenticator app uses.
- We record sign-ins, changes to your account and organization, and each download (the time, the file and your network address), to protect your account and show you your own history. People in your organization with the owner or admin role see who belongs to it; our staff see what they need to support you.
- When you download from obsidiansuite.net or onyxvoice.net, you sign in here and that site sets its own sign-in cookie for downloads (up to 30 days, or until you sign out everywhere from your account).
- We email you only about your account: confirming your address, password resets, invitations and changes to your sign-in.
- Ask us through the support page and we will close your account and delete it.
Children
Our apps are made for work and are not directed at children under 13.
Changes to this policy
If we change this policy we will update this page and its effective date. If a change affects what an app sends anywhere, we will also say so in that app's release notes.
Contact
Questions about this policy or your privacy: [email protected], or use our support page.