ProsentriqPrivacy Policy
What we collect, why, how long we keep it, and how to exercise your rights over it.
1. Who we are
ORTAL TECH ("PROSENTRIQ", "we", "us") is the data controller for personal data processed through the prosentriq.com website and the PROSENTRIQ Detection API (api.prosentriq.com), and the data processor for security telemetry your PROSENTRIQ agent generates on infrastructure you control (see Section 4). Contact our privacy team at privacy@prosentriq.com.
2. What personal data we collect
| Data | Source | Why |
|---|---|---|
| Email address, name and organization name | You, at signup, or your sign-in provider (below) | Account identification, billing, service and security notices |
| Password (stored only as an Argon2id hash), two-factor secret (encrypted) | You, if you sign in with email and password | Authenticating you |
| From Google or Microsoft, if you choose "Continue with Google/Microsoft": your name, email address, whether the provider has verified that email, and your account identifiers (Google: account ID and Workspace domain; Microsoft: object ID and organization (tenant) ID) | Google or Microsoft, when you sign in with them | Signing you in and linking that sign-in to your Prosentriq account. We request only the basic sign-in permissions (openid, email, profile): we receive no access to your mailbox, files, calendar or contacts, and no password |
| From your organization's single sign-on, if your organization sets one up: your name, email address and whether its identity provider has verified that email | The identity provider your organization chose (for example Okta or Microsoft Entra ID), when you sign in through it | Signing you in to that organization; creating your account there the first time, on an email domain the organization has proven it owns |
| Record of accepting our Terms and this policy: document version, time, IP address and browser user agent | Automatically, when you accept | Evidence of what you agreed to and when |
| Sign-in sessions: IP address, browser user agent, time | Automatically, when you sign in | Keeping you signed in, detecting account misuse |
| API keys and sensor credentials (stored hashed) | Generated in the console or at enrollment | Authenticating sensors and integrations |
| Billing details | You, via our payment processor | Processing subscription payments (card numbers are held by our payment processor, never by us directly) |
| IP address of requests to our website/API | Automatically, from connections | Security (rate limiting, abuse prevention), diagnosing faults |
| Support correspondence | You, when you email us | Responding to your request |
We do not collect hardware or device identifiers; there is no device-binding or hardware-ID check anywhere in PROSENTRIQ.
Signing in with Google or Microsoft
"Continue with Google" and "Continue with Microsoft" are optional and limited to work accounts (Google Workspace; Microsoft Entra ID / Microsoft 365). When you use them, Google or Microsoft authenticates you under its own privacy policy and sends us only the information listed above. We keep the account identifier so that future sign-ins reach the same Prosentriq account even if your email changes. We do not use this information for advertising, do not sell it, and do not share it except as described in section 6. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can remove Prosentriq's access at any time from your Google Account (Security → Third-party apps) or your Microsoft account (My Apps / My Account → App permissions); you can then still sign in with email and a password reset.
3. Lawful basis for processing (UK/EU GDPR Art. 6)
- Contract — processing your account and billing data, including sign-in data from Google or Microsoft if you choose to use them, or from your organization's single sign-on, to provide the Service you signed up for.
- Legitimate interests — using request IP addresses and usage patterns to secure the Service against abuse, and anonymized threat telemetry to improve detection accuracy fleet-wide, balanced against your rights as described below.
- Consent — optional analytics cookies (see the Cookie Policy); marketing email, if you opt in separately from transactional account emails.
- Legal obligation — retaining billing records as required by tax law.
- Legitimate interests — keeping a record of your acceptance of our Terms and this policy, to establish and defend legal claims.
4. Security telemetry from Prosentriq sensors
Prosentriq sensors (the host engine, the Kubernetes sensor, log relays and cloud collectors) analyse network, process, file and authentication activity on your systems. What leaves your infrastructure depends on where you run the control plane:
- Hosted control plane (app.prosentriq.com): sensors send security events and findings (for example source and destination addresses and ports, process names and command lines, file paths, user names, and the reasons an activity was scored) to Prosentriq, which processes them to detect, explain and respond to threats on your behalf. Packet payloads, file contents and memory dumps are never sent.
- Self-hosted control plane: all of the above stays on infrastructure you operate.
- Immunity Network (optional, per organization): the IP addresses of high-severity attackers and a reason category are shared with other customers once independently confirmed. Which organization reported an address is never disclosed.
- Threat Hub peering (optional, self-hosted mesh): your own hosts exchange attacker IP addresses with each other directly, over encrypted connections pinned to each host's certificate. Nothing passes through Prosentriq.
- AI investigation assistant (optional, off by default): when you enable it and ask a question, the selected incident's reasons and timeline are sent to the AI provider you configure, with IP addresses, host names, user names and emails replaced by tokens first.
For security telemetry we act as a data processor on your behalf; you remain the controller for data your systems process (for example an attacker's IP address).
5. Cookies & similar technologies
Covered in full in the separate Cookie Policy, which is part of this Privacy Policy by reference.
6. Who we share data with
- Payment processing — a PCI-compliant third-party payment processor handles card data directly; we never receive or store full card numbers.
- Infrastructure & hosting providers — process data on our behalf under data processing agreements, strictly to operate the Service.
- Email delivery — a transactional email provider sends account and security notices (e.g., verification and recovery links) on our behalf.
- Google and Microsoft — only if you sign in with them. They act as independent controllers of your account with them; when you sign in, your browser is redirected to them and they learn that you are signing in to Prosentriq. We send them nothing else about you.
- Your organization's identity provider — only if your organization uses single sign-on. Your organization chooses and operates it; when you sign in, your browser is redirected to it.
- AI provider — only if you enable the optional investigation assistant, and only the redacted incident context described in section 4.
- Legal & safety — if required by law, or to protect the rights, property, or safety of ORTAL TECH, our customers, or others.
We do not sell personal data, and we do not share it with third parties for their own independent marketing purposes.
7. International data transfers
If personal data is transferred outside the UK or EEA, we rely on an adequacy decision or appropriate safeguards (such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses) with the recipient.
8. How long we keep data
- Account data, including your password hash, two-factor settings, sessions and linked Google or Microsoft sign-in identifiers: for the life of your account. When you delete your account (Settings → My security → Delete account) it is erased immediately.
- Records of accepting our Terms and this policy: for the life of your account. When you delete your account we keep only your email address and the versions you accepted and when (no IP address or browser details), for up to 6 years, to establish or defend legal claims; then it is deleted.
- Organizations: when an organization is deleted (by its owner, by its managing service provider, or together with the account of its only member), all access stops immediately and all of its data, including security events, incidents and its audit log, is permanently deleted after 30 days. Until then it can be restored on request.
- Actions you took inside an organization (for example approving or undoing a block) are part of that organization's tamper-evident audit log, identified by your email address. They stay with the organization after you delete your account or leave it, and are deleted with the organization.
- Sign-in sessions: deleted 7 days after they expire (sessions last 12 hours). Sign-in events (time, IP address, sign-in method) are also written to your organization's audit log and kept as long as that log is retained.
- Abuse-prevention counters keyed by IP address or by a hash of an email address (rate limits on sign-in, sign-up and other requests): up to 2 days.
- Records that a one-time code or a signed request has already been used, kept only as a one-way hash so it can't be used twice: they expire within minutes and are deleted within a day.
- Billing records: as required by applicable tax law (typically 6–7 years).
- Security events: 30 days (Trial), 90 days (Pro) or 400 days (Enterprise) on the hosted control plane, then deleted automatically; on a self-hosted control plane, as you configure. Immunity Network indicators expire automatically (72 hours by default unless re-confirmed).
- Support correspondence: up to 3 years after resolution, for service-quality purposes.
9. Your rights
Under the UK GDPR and EU GDPR, you have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate data;
- Erase your data ("right to be forgotten"): delete your account yourself at any time from Settings → My security, including while a new version of our Terms or this policy is waiting for your acceptance; or ask us. This is subject to our legal obligation to retain certain billing records and to the limited records described in section 8;
- Restrict or object to certain processing;
- Port your data to another provider in a structured, commonly-used format;
- Withdraw consent at any time where processing is based on consent (e.g., analytics cookies), without affecting processing before withdrawal;
- Complain to a supervisory authority — in the UK, the Information Commissioner's Office (ICO); in the EU, your local data protection authority.
To exercise any of these rights, email privacy@prosentriq.com. We aim to respond within one month, as required by law. We may need to verify your identity before acting on a request.
10. Security
Passwords, API keys and sensor credentials are stored only as hashes, never in plaintext; two-factor secrets and integration credentials are encrypted. Account recovery is confirmed through a link sent to your email before anything changes. Sign-ins with Google or Microsoft are verified cryptographically, and are tied to your account by the provider's permanent account identifier rather than by email address. Signing in through your organization's single sign-on still asks for your own two-factor code if you have set one up. If someone registered an account with your email address before you proved you own it, the first time you do (by signing in with Google or Microsoft, accepting an invitation, or resetting your password) any password they chose stops working, and we email you a list of the API keys that already exist. A verification link opened in a different browser from the one that signed up asks for the account's password first. See the Security & Compliance page for more, and security@prosentriq.com to report a vulnerability.
11. Children's privacy
The Service is intended for business and professional use and is not directed at children. We do not knowingly collect personal data from anyone under 16.
12. Changes to this policy
We'll update the "Last updated" date above whenever this policy changes, and notify you by email for material changes affecting how we use previously-collected data.