Privacy Policy

Scope

This Privacy Policy explains how Cipherstep collects, uses, stores, and protects information through this website, including the mobile application and SDK penetration-test application form.

It does not govern data processed through a deployed Cipherstep product or under a separate customer agreement. Those activities may be covered by additional contractual terms and data-processing documentation.

Information we collect

When you submit an assessment application, we collect your name, work email, phone number, role, industry, selected platforms, and the explanation you provide about why you would like a penetration test. If you contact us directly, we also receive the information in your correspondence.

Our hosting and security infrastructure may also process limited technical information such as request timestamps, IP addresses, browser information, and security logs as needed to deliver, protect, and troubleshoot the website.

Please do not submit passwords, credentials, source code, regulated data, sensitive personal information, or other confidential material through the application form.

How we use information

We use submitted information to review assessment applications, evaluate technical fit and scope, respond to applicants, schedule follow-up conversations, prevent abuse, secure the website, maintain business records, and comply with applicable law.

We do not use application information to make decisions unrelated to the applicant’s request without providing appropriate notice.

Secure storage

Personally identifiable information submitted through the form is securely stored in access-controlled infrastructure. We use reasonable administrative, technical, and organizational safeguards designed to protect it from unauthorized access, alteration, disclosure, or destruction.

Information is transmitted over encrypted HTTPS connections. Access is limited to authorized personnel and service providers who need it to perform their responsibilities. No system or transmission method can be guaranteed to be completely secure.

No sale or distribution of PII

Cipherstep does not sell, rent, trade, or distribute personally identifiable information submitted through the application form to third parties for their own marketing, advertising, or independent commercial use.

Limited infrastructure and service providers may process information solely on Cipherstep’s behalf to host, secure, maintain, or operate the website. They are authorized to use that information only to provide contracted services and must protect it appropriately. We may also disclose information when required by law, to protect legal rights or safety, or in connection with a corporate transaction subject to appropriate confidentiality and notice requirements.

Privacy-friendly analytics

We use Plausible Analytics to understand aggregate website usage. Plausible is configured without cookies or persistent identifiers and is not used by Cipherstep to track individual visitors across websites or build advertising profiles.

Aggregate analytics may include pages viewed, referral sources, approximate country, device type, operating system, and browser category. We do not intentionally send application-form contents or other personally identifiable information to Plausible.

Retention

We retain application information only for as long as reasonably necessary to review and respond to the application, maintain relevant business and security records, establish or defend legal rights, and satisfy applicable obligations.

When information is no longer needed, we take reasonable steps to delete or de-identify it, subject to legitimate backup, legal, fraud-prevention, and recordkeeping requirements.

Your choices and rights

Depending on where you live, you may have rights to request access to, correction of, deletion of, or a copy of your personal information, and to object to or restrict certain processing. You may also withdraw consent where processing relies on consent.

We do not sell personal information or share it for cross-context behavioral advertising. Because the website does not engage in cross-site behavioral tracking, it does not respond differently to browser “Do Not Track” signals. We will honor legally recognized privacy requests as required by applicable law.

California residents can also read our California Privacy notice.

International processing

Information may be processed in countries where Cipherstep or its service providers operate. Where applicable law requires it, we use appropriate safeguards for transfers of personal information between jurisdictions.

Children

This website and its assessment application are intended for business users and are not directed to children under 16. We do not knowingly collect personal information from children through the application form.

Changes to this policy

We may update this Privacy Policy to reflect changes in our practices, technology, or legal obligations. We will post the updated version here and revise the effective date. Material changes will be communicated through an appropriate additional notice when required.

Contact

For privacy questions or requests, email privacy@cipherstep.com. Please do not include passwords, credentials, or other sensitive information in your request.

Scheduling and external services

Our meeting links take you to Cal.com. Information you provide there is also subject to that service’s privacy terms, and booking details you share with Cipherstep are used to arrange and follow up on your meeting. Other external websites have their own privacy practices.