The data that moves through here, and who gets to touch it.

The company on the hook

The Cyb3rs3cur1ty name belongs to Fortify 24x7. That company decides how data arriving at this shop gets treated, along with data the purchased services later produce. Read every we below as meaning them.

Questions about anything written on this page go to support@cyb3rs3cur1ty.com. A person reads that inbox.

What this website takes from you

Very little, and that is deliberate. Nobody installed advertising trackers here, nothing assembles a picture of your browsing, and not one marketing script has been borrowed from a third party.

• Your inventory. Chosen lines and their quantities live in browser storage under the name c3_cart. They stay on your own machine until a checkout starts, and wiping site data removes them.
• Your session. Signing into the portal stores a token under c3_portal_session so that pages stop asking who you are. Signing out deletes it.
• Service logs. Requests to the billing service leave ordinary technical records behind. Those get read when a fault or an abuse case needs investigating, and never for anything besides.

What buying something tells us

Checkout belongs to Stripe. Card number, expiry date and security code get typed onto Stripe pages, travel to Stripe, and land nowhere near this site or any database of ours.

Coming back the other way is only what an account cannot exist without. A contact address. A company name. The chosen lines and their quantities. Whether payments are current. The reference numbers Stripe keeps at its own end.

What the products themselves handle

Running a security service on your behalf means handling whatever your enrolled systems produce. The detail varies by module.

• Detection lines take in what processes get up to, events on disk and across the wire, identifiers for machines and accounts, and the content of alerts. Investigation is impossible without them.
• Fleet lines take in machine inventory, operating system and patch status, hardware specifications, and, where filtering runs, the addresses a device asked for.
• Email lines examine headers and message bodies for threats inside the tenant you own, plus who did what during a simulation.
• Data protection lines record where regulated material sits, its category, its volume, and a score for each machine.
• Backup lines hold copies of whichever systems you name, and those copies can contain anything sitting on them.

Every bit of that is processed to deliver the service you ordered. None of it feeds a product of ours, and none of it is sold. Treat that as a fixed position rather than a mood we might be talked out of later.

Cases you raise

A case raised through the portal, or over mail, keeps its subject line, its detail, the notes engineers add, and any attachments inside our service desk. Keeping the record attached to the problem is how the next engineer works out what the last one did.

Who else touches it

Managed services run on other people's software, and pretending otherwise would be silly. These processors may handle information while your service is being delivered.

• Stripe handles payments, card data and subscription records.
• Microsoft Azure hosts this website and the billing service behind it.
• Each security vendor listed across the modules handles data for the lines you actually subscribe to.
• Our service desk platform stores the case history described just above.

All of them work to a defined brief, and none may repurpose your information for something of their own.

Retention

• Invoicing and accounting records persist for the periods that tax law sets.
• Case history survives while you are a customer, and for a sensible while afterwards, since past cases explain present configuration.
• Telemetry from the products follows whatever retention your lines carry, which gets documented during setup.
• Backup copies expire on the schedule you agreed when the service was configured.

Requests you can make

Ask, and you will be told what is held, handed a copy, given a correction, or have material deleted where no law and no contract obliges us to keep it. Answers come from a person and nothing is charged for them.

Where the data belongs to a client company and we merely process it, requests from that company's employees get routed to the client, who decides what happens.

How it is looked after

Our own estate runs the products this shop sells. Reaching a customer environment requires multi factor authentication, permission attached to a role, and it leaves a log entry behind. Standing access to environments an engineer is not working in does not exist here.

Revisions

A changed notice gets a changed date at the head of the page. Anything that materially alters how data is handled gets mailed to the account contact, rather than appearing quietly here for you to discover on your own.