Zum Hauptinhalt springen

Privacy Policy

Effective date: February 1, 2026 • Last updated: February 6, 2026

This Privacy Policy describes how CISODIUM OÜ ("Cisodium", "we", "us", or "our") collects, uses, shares, and protects personal data when you visit our website at cisodium.com (the "Website") or use the Cisodium Information Security Management Platform (the "Service"). By using our Website or Service, you agree to the practices described in this policy.

1. Information We Collect

1.1 Information You Provide

  • Account information: name, email address, job title, organization name, and phone number when you register for an account or request a demo.
  • Communications: any information you include when you contact our support team, submit a form, or respond to surveys.
  • Payment information: billing details processed by our third-party payment processor. We do not store credit card numbers on our servers.
  • User content: data you upload to the platform, including security controls, risk assessments, policy documents, and compliance evidence.

1.2 Information Collected Automatically

  • Log data: IP address, browser type and version, operating system, referring URL, pages visited, and timestamps.
  • Device information: device type, screen resolution, and language preferences.
  • Usage analytics: we use privacy-friendly analytics (no personal tracking cookies) to understand how visitors interact with our Website.

1.3 Information from Third Parties

We may receive information from identity providers (via SSO/SAML), integration partners, or publicly available sources to enrich your account profile or verify your identity.

2. How We Use Your Information

We use collected information for the following purposes:

  • Service delivery: to provide, operate, and maintain the Cisodium platform and respond to your requests.
  • Communication: to send transactional emails (account confirmations, security alerts, service updates) and, with your consent, marketing communications.
  • Improvement: to analyze usage patterns, diagnose technical issues, and improve platform features and performance.
  • Security: to detect, prevent, and respond to fraud, abuse, security incidents, and technical issues.
  • Legal compliance: to comply with applicable laws, regulations, legal processes, or enforceable governmental requests.

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, our legal bases for processing your data are:

  • Contract performance: processing necessary to fulfill our contractual obligations to you.
  • Legitimate interests: improving our services, ensuring platform security, and marketing (where not overridden by your rights).
  • Consent: where you have given explicit consent (e.g., marketing emails). You may withdraw consent at any time.
  • Legal obligation: processing required to comply with applicable law.

4. Data Sharing and Disclosure

We do not sell your personal data. We may share data with:

  • Service providers: trusted third parties who assist in operating our platform (hosting, email delivery, payment processing, analytics) under strict data processing agreements.
  • Integration partners: when you enable third-party integrations (e.g., Jira, Slack, SIEM platforms), data is shared as necessary for the integration to function.
  • Legal requirements: when required by law, regulation, subpoena, court order, or to protect our rights, safety, or property.
  • Business transfers: in connection with a merger, acquisition, or sale of assets, with appropriate confidentiality protections.

5. Data Security

We implement industry-standard security measures to protect your data:

  • Encryption: all data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Credentials are stored using HashiCorp Vault or encrypted database storage.
  • Access controls: role-based access control (RBAC) with multi-tenant isolation ensures users can only access data within their organization.
  • Authentication: enterprise SSO via Keycloak with support for multi-factor authentication (MFA).
  • Audit logging: all user actions are logged and traceable for compliance and forensic analysis.
  • Infrastructure: hosted on secure cloud infrastructure with regular vulnerability assessments and penetration testing.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide our services. After account termination, we retain data for a maximum of 90 days before permanent deletion, unless longer retention is required by law or necessary for legitimate business purposes (e.g., resolving disputes, enforcing agreements). You may request earlier deletion by contacting us.

7. International Data Transfers

Your data may be processed in countries other than your own. When we transfer data outside the EEA, we rely on Standard Contractual Clauses (SCCs), adequacy decisions, or other approved transfer mechanisms to ensure appropriate safeguards are in place.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

  • Access: request a copy of the personal data we hold about you.
  • Rectification: request correction of inaccurate or incomplete data.
  • Erasure: request deletion of your personal data ("right to be forgotten").
  • Restriction: request that we limit how we process your data.
  • Portability: receive your data in a structured, machine-readable format.
  • Objection: object to processing based on legitimate interests or direct marketing.
  • Withdraw consent: where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at privacy@cisodium.com. We will respond within 30 days.

9. Cookies and Tracking

Our Website uses only essential cookies required for the site to function (e.g., session management). We use privacy-friendly, cookieless analytics that do not track individual users across websites. We do not use third-party advertising cookies or tracking pixels.

10. Children's Privacy

Our Service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our Website with a revised "Last updated" date. For significant changes, we will provide additional notice via email or an in-app notification.

12. Contact Us

If you have questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us:

If you are in the EEA and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection authority.