Privacy Policy

Account information you give us when you register: email address, and (optionally, collected when you finish setting up your account) your name, company, and country.

Order information: which assessments you purchased, when, payment confirmation from our payment processor (Stripe), and the status of each assessment.

If you use the free email security check, we receive the domain name you enter and a one-way hash of your IP address (never the address itself), and keep them with the resulting grade for up to 30 days to prevent abuse, then delete them.

Assessment data: when you run the collector, we receive your tenant’s security configuration only in tokenised form. The collector script tokenises sensitive values (user names, admin emails, tenant domain and ID, policy and group names, device and domain controller names) on your own device before anything is uploaded — see the Security page for the full token schema. The token-to-real-value mapping is saved locally on your device only and is never sent to us, so we never see the real names.

To create and secure your account, verify your email address, and let you sign in.

To process payment, deliver your purchased assessment(s), and let you track order status and download reports from your buyer portal.

To respond to support requests and send you operational emails about your account or orders (e.g. purchase confirmation, report-ready notifications, reminders about an assessment you have not run yet, password resets). We do not send marketing email.

If you use the signed-in assistant to contact support, the message you review and send — optionally including that chat conversation — creates a support request (ticket) in your account. Replies happen in the Support page in your account, not by email — we only send your account email a notice (no message content) telling you to sign in and check the thread.

Billing records (order, product, amount, date, payment reference and the account that paid) are kept for 7 years to meet tax and audit obligations, then deleted. Orders that were never paid are deleted after 30 days.

Account records are kept for as long as your account is active. An unverified, never-purchased registration attempt is automatically deleted after 7 days.

The tokenised assessment file you upload is deleted as soon as it has been processed. The results we derive from it (scores, findings and tokenised evidence) are deleted 12 months after the assessment.

Generated reports are automatically deleted from our storage, and no longer available for download, 30 days after generation. Downloads are in your account; we never email download links. Any Pass / Fail confirmations you record on a report are deleted when that report expires.

An assessment you have bought can be run for 12 months from purchase; after that it expires.

Support requests you send through the signed-in assistant — including an optional chat transcript, if you chose to include it — are stored for up to 180 days after the request is closed (or up to 365 days if it is never closed).

Other records are kept for 12 months: messages you send to the support assistant and its answers; a record of each Report Advisor message (its date and length, not its text); email delivery records (including bounces and complaints); and sign-in, security and account activity records. Application logs we use to run the service are kept for 30 days.

Deleted data can remain in encrypted backups for up to 35 days. Support conversations follow their own retention period above.

Microsoft Azure, which hosts our service in its Southeast Asia (Singapore) region: our database, file storage, and the application logs and monitoring we use to keep the service running.

Cloudflare, which hosts this website, routes email sent to our support address, and runs the Turnstile check on sign-up, password reset and the free email security check (Turnstile sees your IP address to tell people from bots).

Stripe, to process payment. We never see or store your card details.

Resend, to deliver transactional email notices (order and report notices, support ticket notices, password resets). Emails never contain download links or your support messages.

Anthropic, to power our AI features: the Advanced-tier executive summary (generated only from tokenised, anonymised assessment data), the support assistant and Report Advisor chats (the messages you type, plus — when you are signed in — a summary of your own orders and report status), and an AI assistant that helps triage and draft replies to support tickets (your ticket messages plus your own order and scan status — never billing actions, refunds, or account changes, which always go to a person). A person reviews every AI-drafted reply before it reaches you unless we have separately told you a category is fully automated; anything the assistant can’t safely resolve is escalated to the founder. We don’t include your email address, name or company in what we send, but anything you type in a chat or ticket is sent as written. Your token map and your tenant’s real names never leave your machine.

We do not sell your data. Apart from the service providers above, we share it only if the law requires us to.

We use one essential cookie, buyer_session, to keep you signed in to your account. It is secure, not readable by scripts, and expires after 7 days or when you sign out.

We do not use analytics or advertising cookies. Cloudflare may set its own security cookie when the Turnstile check runs.

You can change your password, or sign out of your account, from the buyer portal at any time.

To request a copy of your data, or to ask us to delete your account, email support@365posture.net. Note that we may need to retain order/payment records for the retention period above even after an account-deletion request, for tax and audit purposes.

We handle personal data in line with Singapore’s Personal Data Protection Act 2012 (PDPA).

If we change this policy, we update this page and the date below. If a change affects how we use your data in a significant way, we also send a notice to your account email.