Cyber Resilience Platform

1) Overview

This notice explains how Cyber Resilience Platform collects, uses, and protects information when you explore our public site, start a trial, or use the product for CRA readiness, SBOM intelligence, and remediation workflows. We only process data needed to deliver and secure the service, meet legal requirements, and support our customers.

2) Data we collect

• Account data: name, email, company, role, authentication details, and billing identifiers when you subscribe.
• Product content: assessments, remediation plans, SBOM artifacts, evidence uploads, comments, and configuration you or your org choose to store.
• Usage & telemetry: device/browser info, IP address, timestamps, feature usage, and limited event metadata to operate, secure, and improve the service.
• Support interactions: messages, call notes, and troubleshooting artifacts you share with our team.
• Site analytics: privacy-aware analytics and cookies that help us understand visits to our marketing pages.

3) How we use data

• Provide the product: authenticate users, deliver assessments, SBOM intelligence, notifications, and remediation workflows.
• Secure the platform: detect abuse, monitor availability, and investigate incidents.
• Support & success: respond to tickets, provide onboarding, and recommend features that match your use case.
• Communications: send transactional emails (password resets, billing, critical updates) and optional product updates; you can opt out of non-essential messages.
• Compliance: meet legal obligations, enforce terms, and maintain audit records where required.

4) Legal bases (EU/UK)

Where GDPR or UK GDPR applies, we process personal data based on: (a) performance of a contract when delivering the service; (b) legitimate interests such as securing the platform and improving features (balanced against your rights); and (c) consent for specific activities like optional marketing where required. You may withdraw consent at any time.

5) How we share data

• Service providers: vetted vendors for hosting, storage, email delivery, analytics, payments, and support tooling, bound by confidentiality and data protection terms.
• Analytics providers (optional): if you allow analytics, we send usage data to third-party analytics services to understand how features are used and improve Cyber Resilience Platform. We do not use these tools for ads.
• Customer admins: data within your workspace is visible to your organization’s authorized users according to configured roles.
• Legal & compliance: where required by law, to protect rights, or to investigate abuse or security events.
• Business changes: in a merger, acquisition, or reorganization, data may transfer under the same or stronger protections.

6) Security

We apply layered security: encryption in transit and at rest, strict access controls, least-privilege roles, logging, and monitoring. No system is perfectly secure, so we maintain incident response procedures and will notify customers of material breaches as required by law or contract.

7) Retention

We retain personal data while your account is active or as needed to provide the service. Backups and logs are kept for limited periods for security, continuity, and audit obligations. When retention ends, we delete or de-identify data unless longer storage is required by law.

8) Your rights

Depending on your location, you may have rights to access, correct, delete, or export your personal data; object to or restrict certain processing; and opt out of non-essential communications. You can exercise many rights within the product or by contacting us. We may need to verify your identity and coordinate with your organization’s administrator for workspace data.

9) International transfers

Cyber Resilience Platform may process data in regions where we or our providers operate. When analytics is enabled, third-party analytics providers may process data in the United States (or other regions where their infrastructure runs). For transfers from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as Standard Contractual Clauses and complementary controls where required.

10) Cookies & tracking

We use cookies and similar technologies for authentication and session continuity. If you allow analytics, we also load third-party analytics tools; these set identifiers (e.g., cookies or local storage) and collect usage events to help improve the product. We do not use these tools for advertising. You can manage cookies in your browser and opt out of analytics via the consent banner or account privacy settings. Blocking cookies may impact functionality.

11) Changes to this notice

We may update this policy to reflect operational, legal, or regulatory changes. If updates are material, we will provide reasonable notice (e.g., in-product banner or email). Continued use of the service after an update means you acknowledge the revised policy.

12) Contact

Questions or requests about this notice? Contact us via the Get in Touch section on the landing page.