1. We collect only what we need to run a penetration testing engagement and respond to website inquiries.
2. We do not sell personal data, ever, in any form.
3. You can email [email protected] at any time to access, correct or delete your data.
// 01 Data controller
The data controller for the personal data processed under this policy is CyberFortify, headquartered at 1209 Mountain Road Pl NE STE R, Albuquerque, NM 87110, United States. Contact: [email protected].
// 02 What we collect
- Inquiry data - name, business email, company, phone (optional), and free-text engagement description submitted through the contact form or by email.
- Engagement data - technical scoping details, in-scope assets, test accounts and any data the customer chooses to share for the engagement.
- Website usage - aggregate analytics covering pages visited, referrer and approximate location at country / region level. We do not use third-party advertising trackers.
- Communications - email correspondence, scheduled-call records and recordings only with explicit consent.
// 03 Why we collect it
Personal data is processed for the following purposes only:
- Responding to engagement inquiries and partner requests
- Performing pre-engagement scoping, contracting and statement-of-work preparation
- Delivering offensive security engagements under signed authorisation
- Producing reports, attestation letters and remediation retests
- Maintaining records for legal, regulatory and audit purposes
- Improving our website and content quality
// 04 Lawful basis (GDPR)
Where GDPR or UK GDPR applies, the lawful bases for our processing are:
- Article 6(1)(b) - performance of a contract for engagement-related processing
- Article 6(1)(f) - legitimate interest for inquiry response and website analytics
- Article 6(1)(c) - legal obligation for record retention and tax / accounting
// 05 Sharing & sub-processors
We do not sell, rent or otherwise commercialise personal data. Personal data is shared only with sub-processors strictly necessary to operate our business: hosting providers, email infrastructure, accounting software and contract-management platforms. A current list of sub-processors is available on request to [email protected].
// 06 Security
CyberFortify is an offensive security firm. We hold ourselves to the controls we recommend our customers adopt: encryption in transit and at rest for sensitive data, strong identity controls, principle-of-least-privilege access, audit logging and regular technical evaluation. Engagement data is encrypted, held only as long as the engagement and the contractually agreed retention window require, and securely destroyed at the end of that window.
// 07 Retention
- Inquiry data: up to 24 months from last contact
- Active engagement data: duration of the engagement plus contractually agreed retention (typically 12 months for the report attestation cycle)
- Accounting / tax records: 7 years (US tax retention) or longer where required by jurisdiction
- Website analytics: aggregated; raw logs retained 13 months maximum
// 08 Your rights
Subject to applicable law, you have the right to access, correct, delete, restrict processing, object to processing, and request portability of your personal data. To exercise any of these rights, contact [email protected]. We will respond within 30 days. Where we operate as a data processor on behalf of a customer, requests should be directed to that customer first.
// 09 International transfers
CyberFortify is headquartered in the United States. Personal data submitted from outside the United States may be transferred to and processed in the US. Where data is transferred from the European Economic Area or the United Kingdom, transfers are made under Standard Contractual Clauses (Module 1 / 2 / 3 as applicable) plus additional safeguards.
// 10 Cookies
This website uses a small number of strictly necessary cookies plus first-party analytics cookies. See the cookie policy for the full list and consent controls.
// 11 Changes to this policy
This policy may be updated from time to time to reflect operational, legal or regulatory changes. The "Last reviewed" date at the top of this page reflects the latest revision. Material changes will be communicated to existing customers by email.
// 12 Contact
Questions about this policy or about how CyberFortify processes your personal data: [email protected] or 1209 Mountain Road Pl NE STE R, Albuquerque, NM 87110, USA.