Privacy and Data Handling

Extendy GeoShield runs inside the customer’s WHMCS installation and stores its addon records in the customer-controlled WHMCS database environment.

This page describes the current technical data handling behaviour of the addon. It does not replace your organisation’s privacy notices, policies, contractual terms, data protection documentation, or legal review.

warning

This documentation is not legal advice and does not guarantee compliance with GDPR, UK GDPR, or any other privacy or security framework. Operators remain responsible for assessing their own obligations and the services they configure.

Why Extendy GeoShield processes data

Extendy GeoShield processes login-related metadata to:

• record client-area login events;
• resolve a usable client IP address;
• look up a GeoIP country for that IP address;
• evaluate alert decisions;
• send security notification emails when configured rules require them;
• operate Smart Mode known-country behaviour;
• generate and validate Smart trust links;
• display the read-only Login Events Log;
• support safe troubleshooting of provider and email failures;
• clean up login event rows according to the retention setting.

Extendy GeoShield is notification-only in the current MVP. It does not block logins and does not replace WHMCS authentication controls.

Data stored in the WHMCS database

The current implementation creates and uses the following addon tables:

mod_extendy_geoshield_events
mod_extendy_geoshield_known_countries
mod_extendy_geoshield_trust_tokens
mod_extendy_geoshield_settings

These tables are stored in the WHMCS database used by the customer’s WHMCS installation.

Login event records

Login event records may include:

Category	Examples
Login actor context	WHMCS User ID, user email snapshot
Client context	Client Account ID when safely resolved, or no client context
IP context	resolved public client IP address when available
IP source metadata	configured source, source used, source verification state, safe resolution reason
GeoIP context	country code, country name, selected provider
Alert context	alert mode, alert decision result, decision reason, alert template, alert sent state, safe alert error
Timing	event creation and update timestamps

If no valid public client IP can be resolved, the event may be logged without an IP address.

The event table includes a nullable user-agent field in the schema, but the reviewed current login flow does not populate user-agent data.

For the admin view, see Login Events Log.

Known country records

Smart Mode and trust-link actions can store known country records.

These records include:

• WHMCS User ID;
• Client Account ID when applicable, or no client context;
• country code;
• source, such as trust-link based trust;
• first seen, last seen, created, and updated timestamps.

A known country with no client context does not automatically become trusted for all linked Client Accounts.

For behaviour details, see Trusted Countries and Smart Mode.

Trust token records

Smart New Country alert emails may include a trust link.

For eligible Smart alerts, Extendy GeoShield generates an opaque token for the URL and stores only a SHA-256 token hash in the database.

Trust token records include:

• token hash;
• WHMCS User ID;
• Client Account ID when applicable;
• country code;
• IP address when available;
• expiry timestamp;
• used timestamp when consumed;
• created and updated timestamps.

The raw token is not stored in the database. It appears only in the generated trust URL and later request input.

Trust tokens expire after 48 hours and are one-time-use through the used_at field.

Settings and provider credentials

Addon settings are stored in:

mod_extendy_geoshield_settings

Non-secret settings include values such as:

• addon enabled state;
• alert mode;
• global trusted countries;
• selected GeoIP provider;
• country-detection-failure behaviour;
• alert cooldown;
• retention setting;
• trust link expiry;
• IP source mode;
• trusted proxy CIDRs.

Provider credentials are stored in the same settings table as encrypted values using the verified WHMCS Local API EncryptPassword / DecryptPassword mechanism.

Current credential fields are:

• IPinfo API Token;
• MaxMind Account ID;
• MaxMind License Key.

The admin UI displays stored credentials as masked values only. Leaving a credential field empty during settings save keeps the existing stored value. The UI provides explicit clear/remove actions for stored credentials.

Client IP and GeoIP data

Client IP resolution happens before GeoIP lookup.

Extendy GeoShield accepts only valid public client IP addresses for GeoIP lookup. Private, loopback, local, documentation, reserved, malformed, and otherwise ineligible IP addresses are rejected before provider credentials are retrieved or a provider call is made.

For IP source behaviour, see:

• Client IP Source Modes
• Proxy Setup
• Cloudflare Setup

GeoIP country data is contextual security metadata. It does not verify identity, does not prove who performed a login, and does not mean a login is safe.

Third-party GeoIP provider data flows

Extendy GeoShield can send a resolved public IP address to the selected GeoIP provider.

The operator supplies and controls the provider credentials. Provider terms, privacy notices, logging, retention, billing, and availability are external to Extendy GeoShield.

For provider setup, see GeoIP Providers Overview, IPinfo Setup, and MaxMind Setup.

IPinfo

The current IPinfo integration uses HTTPS and the IPinfo Lite endpoint:

https://api.ipinfo.io/lite/{IP}

The queried public IP address is included in the request path.

The IPinfo token is sent in the HTTP Authorization: Bearer header. It is not placed in the request URL and is not included in normalised error output.

MaxMind

The current MaxMind integration uses HTTPS and the MaxMind GeoIP2 Country web service endpoint:

https://geoip.maxmind.com/geoip/v2.1/country/{IP}

The queried public IP address is included in the request path.

The MaxMind Account ID and License Key are supplied to the HTTP client using Basic authentication. They are not placed in the request URL and are not included in normalised error output.

Provider Test Connection

The Settings page includes a provider Test Connection feature.

The test uses the saved provider setting and saved credentials, validates the submitted test IP before credential retrieval, and does not create login event records.

The provider test activity log records only safe summary information such as provider, status, and outcome. It does not log the test IP or credentials.

Email alert data flow

Extendy GeoShield uses the WHMCS Local API SendEmail with a safely resolved Client ID context.

For the current MVP recipient model:

• alert emails are sent to the primary WHMCS Client Profile email for the safely resolved client_id;
• the WHMCS User email remains the login actor and is included in email content as user_email;
• no email is sent when no safe Client Account context is available;
• copied recipients on Extendy GeoShield templates are blocked before sending.

Alert email variables may include login-related values such as:

• client name;
• primary Client Profile email;
• WHMCS User email;
• login IP;
• login country and country code;
• login time;
• GeoIP provider;
• alert mode;
• Smart trust URL when applicable;
• support URL.

Final email delivery depends on the customer’s configured WHMCS mail transport and any external mail provider used by that WHMCS installation. Extendy GeoShield does not control external mail-provider retention or delivery behaviour.

For email details, see Email Alerts and Email Templates and Variables.

WHMCS Activity Log entries

Extendy GeoShield writes only safe summary activity entries where implemented.

Examples include:

• settings updated;
• provider test summary;
• email skipped or failed summary;
• retention cleanup deleted row count;
• retention cleanup controlled failure.

These entries are intended for operational diagnostics and should not include provider credentials, raw provider responses, raw trust tokens, request headers, cookies, or database credentials.

WHMCS Activity Log retention and handling are part of the operator’s WHMCS environment and are outside Extendy GeoShield login-event retention cleanup.

Data not sent to Extendy-operated services

The reviewed current addon runtime implementation does not send login event records, provider credentials, trust tokens, known countries, or addon settings to an Extendy-operated remote service.

The reviewed current addon runtime implementation does not include:

• telemetry reporting to Extendy;
• analytics tracking from the addon runtime;
• licence validation calls;
• manual update availability checks;
• automatic Cloudflare range downloads;
• customer data export to Extendy.

This statement describes the reviewed current implementation only. Future versions should be reviewed against their own release documentation.

Security and privacy boundaries

Keep these boundaries in mind:

• IP address and country are contextual security data, not proof of identity.
• ip_source_verified means the configured IP source/header was accepted for use; it does not mean the visitor is trusted.
• A trusted proxy is not a trusted end user.
• A trusted country is not a trusted user.
• A GeoIP country result does not authenticate a WHMCS User.
• Alert delivery is not guaranteed.
• Extendy GeoShield does not block login in the current MVP.
• Extendy GeoShield does not replace WHMCS authentication controls.

Retention relationship

Login event records follow the configured Extendy GeoShield retention setting.

The current retention cleanup removes only old rows from the login events table. It does not automatically remove known country records, trust token records, settings, credentials, email templates, WHMCS Activity Log entries, or independent backups.

For details, see Retention.

Operator responsibilities

Operators should assess whether their own documentation and processes need to reflect their use of Extendy GeoShield, including:

• privacy notices;
• internal security policies;
• retention policies;
• contractual terms;
• data protection documentation;
• GeoIP provider terms and privacy notices;
• mail transport/provider terms and privacy notices;
• backup and staging environment retention.

Extendy GeoShield does not provide built-in subject access request, export, anonymisation, or per-user erasure workflows in the reviewed current implementation.

Operators should use appropriate WHMCS, database, backup, and operational processes for requests or obligations that apply to their environment.