Privacy Policy

1. What this covers

This Privacy Policy explains what information CyberEnforced ("we," "us") collects when you use the Service, how we use it, and who we share it with. The operator is Cloudappsolutions Inc. At account creation we also show a short notice of the account and technical data described below, with a link to this policy.

2. Information we collect

• Account information: your email address and password (stored as a salted hash, never in plain text).
• Organization data: organization name, membership, and role (owner, admin, security manager, analyst, viewer).
• Domain and scan data: the domains your organization adds and the DNS/SPF/DMARC/TLS results, findings, and security scores we generate from scanning them.
• Project and task data: projects, assignments, and due dates your organization creates to track remediation.
• Usage data: basic technical data (like IP address and browser type) collected automatically to operate and secure the Service.
• Contact messages: the name, email address, and message you send through the contact form or the enterprise-ready early-access form, used to reply to that inquiry. A signed-in owner, admin, or security manager can also send a feature request from the Integrations page. That request includes the feature title, the priority you choose, and the organization name. If the address that opened this browser tab included campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, or utm_content), those values are included in the same email.
• Directory data you connect: if an organization connects Microsoft Entra, we request that directory's users (name, user principal name, whether the account is enabled, and user type), MFA registration status, and conditional access policy state, so the organization can see that inventory in the Service.

3. How we use information

• To provide the Service: running scans, computing findings and scores, and displaying your organization's data back to your organization's members;
• To send transactional email: invitations, overdue-finding reminders and digests, and Pro certificate alert schedules;
• To secure the Service and prevent abuse; and
• To improve the Service.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. See section 8 and Your Privacy Choices.

4. Who we share it with

We use the following sub-processors to run the Service. Each processes data only on our behalf and only as needed to provide their part of the Service:

• Supabase: database, authentication, and row-level access control for all account, organization, domain, and finding data.
• Vercel: application hosting for the web app, including scheduled jobs.
• Render: hosting for the background worker that performs domain scans.
• Resend: delivery of transactional email (invitations and reminders).
• Stripe: card payment processing, only if card checkout is turned on for that environment. Production billing is by invoice. Stripe is listed because the product can send a customer there when those keys are configured.
• Microsoft: Microsoft Entra ID and Microsoft Graph, only when an organization connects its directory. We send the tenant id and app credentials that organization saved, and we receive the directory data described above. When an organization connects an Azure subscription, we also send those app credentials to Azure Resource Manager and receive the subscription name, id, and state.
• Amazon Web Services: only when an organization connects an access key. We sign a GetCallerIdentity request with that key and receive the account id. We do not list AWS resources.
• Google Cloud: only when an organization connects a service account key. We sign a token request with that key, then read the project name and id. We do not list Google Cloud resources.
• YouTube (Google) and Vimeo: only if a training course includes a video and a member clicks Load video. Until that click, the player is not loaded.
• Certificate transparency and registration lookups: the scanner queries crt.sh with the domain name being checked, and rdap.org with a public IP the organization added. Those lookups do not include the member's email address.
• Alert destinations the organization chooses: Slack, Microsoft Teams, Discord, Google Chat, PagerDuty, or another webhook receives finding alerts only when that organization saves the URL. A PagerDuty integration key is sent to PagerDuty in the event body.
• Cloudflare Turnstile: on the contact, signup, and invite forms, only when bot protection is turned on for that environment. The form then loads Cloudflare's challenge script. We send the challenge result, and may send the IP address of the submission, to Cloudflare so it can say whether the submission looks automated. When bot protection is off, that script is not loaded and nothing is sent to Cloudflare for this check.

We don't share your data with anyone else except where required by law, to protect our rights, or with your direction. Service providers who process data only on our instructions are not a sale or a share for cross-context behavioral advertising.

5. Cookies and session data

We use a session cookie, set by our authentication provider, to keep you logged in. We don't use third-party advertising or tracking cookies. We do not record keystrokes or use session-replay on the CyberEnforced site. See our Cookie Policy for the same disclosure. A training course may include a YouTube or Vimeo video. That player loads only after a member clicks Load video, and only then can that host set its own cookies.

Site measurement: we do not load a site-analytics script. Page views are not sent to an analytics vendor. Advertising scripts are not loaded. Before a measurement tool is turned on, name it in this paragraph and in the Cookie Policy. A cookieless tool is still named here. Naming it does not, by itself, mean the site sets a non-essential cookie.

Campaign parameters in the page address (utm_source, utm_medium, utm_campaign, utm_term, utm_content) are kept in this browser tab only, in session storage. Session storage is not a cookie. We do not send those values to an analytics vendor. We include them only in the email for a contact or early-access submission, then they leave this tab when you close it.

6. Data retention

We retain your organization's data for as long as your organization has an active account. If you delete your organization or account, we delete the associated data within a reasonable period, except where we're required to keep it longer (for example, for legal or security reasons). That retention period applies to the categories in section 2. How to delete a login, and how to ask for an organization to be deleted, is on the data deletion page.

7. Security

Data is encrypted in transit. Access to another organization's data is restricted at the database level (row-level security), not just in the application, so one organization's members cannot query another's data through the Service.

8. Your rights, including California

You can access and update most of your account and organization data directly in the Service. To request access, correction, or deletion, email privacy@cyberenforced.io. We will acknowledge a verifiable request and respond within 45 days. If we need more time, we will tell you, within the limits the law allows. We may need to confirm that you control the email address on the account before we complete the request.

An authorized agent may submit a request for you. The agent should include proof of authorization, and we may still ask you to verify the request directly.

For California residents, here is the same collection at a high level:

• Identifiers and account credentials (email address and a password stored only as a hash). Purpose: create, authenticate, and secure your account. We use account credentials only to provide and secure the account. We do not use them to infer characteristics about you or for advertising.
• Professional and organization information (organization name, membership, and role). Purpose: provide the Service to your organization.
• Customer content (domains you add, scan results, findings, projects, and tasks). Purpose: run the checks you request and show the results to your organization.
• Internet or other electronic network activity (IP address and browser type, plus the session cookie in section 5). Purpose: operate and secure the Service.

We keep these categories for the retention period in section 6. We do not sell personal information. We do not share personal information for cross-context behavioral advertising. Because we do not sell or share personal information that way, there is no sale or share to opt out of. The Your Privacy Choices page states that again and explains how to email a rights request.

Depending on where you live, you may have additional rights under laws like the GDPR or the CCPA/CPRA. Contact us and we'll address your request under the law that applies to you.

9. Children's privacy

The Service is a business product for people who are at least 18 years old. It is not intended for children under 13, or under 16 where that higher age applies. We do not knowingly collect personal information from anyone under those ages. If you believe we have, email us and we will delete it.

10. International data transfers

Our infrastructure providers may process and store data in the United States or other countries. Where required, we rely on appropriate safeguards for any such transfer.

11. Changes to this policy

We may update this Privacy Policy from time to time. We'll update the "Last updated" date above when we do, and for material changes we'll make reasonable efforts to notify account owners.

12. Contact

Questions about this policy, or a privacy rights request? Email privacy@cyberenforced.io, or write to us at 333 Swanson Drive, STE 107, Lawrenceville, GA 30043.