Clause 01The categories we keep
| Account | Name, work email, company. The minimum required to provision what you bought and to reach a person when a control fires. |
|---|---|
| Payment | Subscription and receipt records. Cards are handled by Stripe from one end to the other and never arrive on our infrastructure. We see the final four digits and whether it went through. |
| Security telemetry | What the agents send us: process activity, detections, patch and configuration state, device inventory, mail verdicts, and the case notes our analysts write out of all of it. |
| Protected content | On the backup lines, the material being protected, encrypted with 256-bit AES on disk and secured on the wire. It is your property under our custody. It is not a dataset of ours. |
| Server logs | Conventional web logs of address, time, and page. Nothing profiling, nothing advertising. |
Clause 02The uses we put it to
Standing the services up, running them, billing them, supporting them. Looking into what the agents report and telling you what we found. Meeting obligations imposed on us by tax and by law. There is no further item on the list. Personal information is never sold by us, and nothing held on your behalf is mined, sampled, or fed into the training of any model. Telemetry gathered from a customer exists to defend that customer.
Clause 03Everyone else who comes near it
A short roster of processors the service genuinely cannot run without: Stripe for card payments, the security and backup vendors we name on the solution pages for the platforms themselves, and a delivery provider that carries the sign-in links, the alerts, and the receipts. Each works to our instruction and to no agenda of its own. Where a subpoena or a court order arrives, we satisfy precisely what it requires of us and not a line further.
Clause 04How long any of it stays
Telemetry and case records are held for the analysis window attaching to the line you bought. Protected content follows whatever retention that line publishes, which might be 28 days of file versioning, seven years of mail, or an open-ended history on directory configuration. Once a subscription finishes, what was held under it is removed on the deprovisioning timetable of the vendor concerned. Billing and account records persist for whatever period tax and accounting rules impose on us.
Clause 05Rights you can exercise
People resident in California, and in a growing number of other places, hold statutory rights to obtain, correct, port, or delete the personal information a business keeps about them. Write in from the address on the account and we will give effect to whichever of those reach you. Note that removing an account, and removing what sits underneath it, cannot be undone, so expect us to confirm before acting.
Clause 06Reaching us
Fortify 24x7 / support@cyberdefense.software