Scope
This policy covers two kinds of information: details you give us through this website, such as sign-up and contact forms, and data processed inside a customer workspace when the service tests controls and generates evidence. For workspace data, the customer organisation decides what is connected and remains in control of it, and we process it on their instructions.
Information we collect
- Sign-up and contact details: name, work email, company, role, industry, team size, the frameworks you are interested in and any message you send.
- Workspace data: control results, evidence records, remediation tickets, policies and the configuration or access metadata read from systems you connect.
- Technical data: a session cookie used to protect forms from automated abuse, and standard server logs such as IP address and request time.
Control tests are designed to read configuration and access metadata rather than the business content of your systems. Where a test must touch sensitive data, only the minimum needed to produce a result is kept.
How we use information
- To create your account and send your login credentials
- To respond to demo, pricing, security and partnership requests
- To run control tests, generate evidence and track remediation for your workspace
- To secure the service, prevent abuse and investigate incidents
- To meet legal obligations that apply to us
Sharing
We do not sell personal data. We share information only:
- With service providers that host the service or deliver email on our behalf, under confidentiality and data protection terms
- With auditors or other parties you choose to grant access to your evidence
- Where required by law or to protect the rights and safety of users and the service
Retention
Sign-up and contact details are kept while we have an active relationship with you and for a reasonable period afterwards. Workspace evidence is kept for the retention period configured for that workspace. When a subscription ends, workspace data can be exported on request and is then deleted, except where the law requires us to keep certain records.
Security
Information is encrypted in transit and at rest, access is restricted by role and logged, and evidence records are sealed so changes can be detected. More detail is on the Security page.
Your rights
Depending on where you are, you may have the right to access, correct, delete or restrict the use of your personal data, to object to processing and to withdraw consent. Applicable laws may include the Digital Personal Data Protection Act 2023 in India and the GDPR in the European Economic Area. To make a request, use the contact form and we will respond within the period the law requires.
Cookies
This website uses a single strictly necessary session cookie to verify form submissions. It is not used for advertising or cross-site tracking.
Changes to this policy
We may update this policy as the service evolves. Material changes will be communicated to account holders by email or within the service before they take effect.