Privacy Policy

What is held

• Account. A name, an email address, a company. Enough to build your tenant and to reach a person quickly when something is on fire.
• Billing. Records of what you subscribed to, and the receipts. Stripe holds the card end to end; nothing of it lands on our infrastructure beyond four trailing digits and a success or failure flag.
• Security telemetry. This is the substance of the service. Process execution and lineage, file and script activity, and network connections from the agent. On XDR tiers it also covers mail flow metadata and verdicts, cloud control-plane and workload events across AWS, Azure and GCP, network session records, and Active Directory authentication and change events.
• Case records. Detections, the analyst notes written about them, the actions taken, and the escalations you raised in the portal.
• Site logs. Plain web server records covering address, time, and which page. Nothing that profiles a visitor, and no advertising tags whatsoever.

Telemetry is security data, not content archiving. The agent records what a process did, not the contents of the documents your staff were editing. Mail sources yield headers, routing, and verdicts rather than a copy of everyone's correspondence.

What it gets used for

• Detect, triage, and at the XDR+ tiers remediate security events in your estate.
• Notify you when something needs your attention, and invoice the service.
• Improve the detection content we maintain. Where an incident teaches us something, the lesson becomes a rule or a tuning change that protects every client. That transfer carries the technique, never your identity or your data.
• Satisfy what tax law and other regulation require of us.

Nothing beyond those four. Personal information is never put up for sale. Your telemetry is not rented into a threat-intelligence marketplace, not fed to a model we license onward, and never enriched into profiles of the people who work for you.

Who else can see it

Only the processors this service cannot run without. SentinelOne supplies the agent platform and console. Fluency supplies correlation and analytics. Stripe takes payments. Cloud infrastructure vendors host the estate, and one mail provider delivers receipts, alerts, and login links. Each add-on module brings the vendor behind that module, and no one else.

Every one of them acts on instruction from us, never on an agenda of its own. Where a subpoena or court order lands, we hand over precisely what is compelled and nothing beyond it, and we notify you unless notification itself is prohibited.

Retention

Security telemetry is retained on the platform schedule for the tier you bought, which is what makes retrospective hunting possible after a threat is disclosed publicly. Case records and analyst notes are kept for the life of the account so that the history of your estate stays readable.

Once a subscription closes, telemetry falls off according to the teardown timetable our platform vendors operate. Account and invoice records stay only as long as accounting and revenue rules oblige us to hold them.

Your rights

California residents, and people in a growing number of other jurisdictions, have rights in law to inspect, amend, take a copy of, or delete personal information held about them. Send the request from your account address and whatever applies to you will be honored.

One caution worth stating plainly: erasing telemetry erases the evidence trail. If an investigation is open, or a regulator or insurer may later ask what happened, tell us before you ask for deletion. We will confirm the consequence before acting, and deletion is not reversible.

Contact

Fortify 24x7 · soc@s1xdr.com