Privacy Policy

1.1 Information You Provide

We collect information that you voluntarily provide when using our Services:

• Account Information: Name, email address, company name, phone number, job title
• Billing Information: Payment details, billing address, tax identification numbers
• Profile Information: Preferences, communication settings, profile pictures
• Support Communications: Information provided in support tickets, emails, or calls
• Survey and Feedback: Responses to surveys, product feedback, testimonials

1.2 Information Automatically Collected

We automatically collect certain information when you use our Services:

• Usage Data: Features used, actions taken, time spent, frequency of use
• Device Information: IP address, browser type, operating system, device identifiers
• Log Data: Access times, pages viewed, API calls, error logs
• Location Data: General location based on IP address
• Cookies and Tracking: Session cookies, analytics cookies, preference cookies

1.3 Certificate and Infrastructure Data

As a certificate lifecycle management platform, we process:

• Certificate metadata (not private keys unless specifically authorized)
• Domain names and IP addresses associated with certificates
• Certificate authority information and validation data
• Infrastructure configuration data necessary to provide the Services

Data Storage

Your data is stored in secure, SOC 2 Type II certified data centers located in the United States and European Union. We use industry-leading cloud infrastructure providers including AWS and Azure, with data encrypted at rest using AES-256 encryption.

Security Measures

We implement comprehensive security measures to protect your information:

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for data at rest
• Multi-factor authentication (MFA) for user accounts
• Role-based access controls (RBAC)
• Regular security audits and penetration testing
• 24/7 security monitoring and incident response
• Automated vulnerability scanning
• Employee security training and background checks

Data Retention

We retain your information for as long as necessary to provide the Services and comply with legal obligations. After account termination, we retain data for 30 days for account recovery, then securely delete it unless longer retention is required by law or for legitimate business purposes (e.g., audit records retained for 7 years).

Service Providers

We work with trusted third-party service providers who assist in operating our Services:

• Cloud hosting providers (AWS, Azure, GCP)
• Payment processors (Stripe)
• Analytics services (Google Analytics, Mixpanel)
• Customer support tools (Zendesk, Intercom)
• Email delivery services (SendGrid)

Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you of any such change.

Legal Requirements

We may disclose information when required by law, legal process, or to protect rights, safety, and security. We will notify you unless prohibited by law.

With Your Consent

We may share information with other third parties when you explicitly consent to such sharing.

EU-U.S. Data Transfers

For transfers from the European Economic Area (EEA) to the United States, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission and implement additional safeguards as required.

Data Localization Options

Enterprise customers can choose specific geographic regions for data storage to meet local data residency requirements. Contact sales for details.