Privacy Policy

For information about people who visit our website, create accounts, or pay for the Service (account, billing and usage data), Valitura is the controller.

CISO Doc is used by security consultancies and advisors to manage engagements for their own clients. For the client, risk, vendor, document and other engagement information that our customers enter into the Service ("Customer Content"), we act as a processor (or "service provider") on the customer's instructions. The customer decides what to enter and is responsible for having a lawful basis and giving any required notices to the people the information is about. If you are an individual whose information appears in a customer's workspace, please contact that customer about your information.

• Account information: your name and work email address. We do not use passwords. You sign in with Google, your company's single sign-on, or a one-time code that we email to you, which expires shortly after it is sent. If you enable multi-factor authentication we also store the related settings and recovery codes.
• Customer Content: client profiles, interview answers, documents, risk and vendor records, compliance calendar items, remediation items, comments, uploaded files and evidence, and similar content that you or your team enter.
• Vendor questionnaire respondents: if a customer invites you to complete a questionnaire, we process your email address, your answers and any evidence you upload, on that customer's behalf.
• Billing information: your plan, subscription status and Stripe customer identifier. Card details are collected and stored by Stripe, not by us.
• Activity and audit records: sign-ins, sign-outs, document saves, exports, permission changes and similar security-relevant actions, with the time and the account that performed them.
• Technical information: IP address, browser type and request data, which our hosting and network providers process to deliver and protect the Service.
• Integration data: if you connect Slack or Google, the access tokens needed to act on your behalf, and the content we send to those services (see section 6). If you connect GitHub, the identifier of the GitHub installation and read-only snapshots of security settings such as branch protection, the list of people with administrator access, whether two-factor authentication is required, and the number of open dependency alerts. This can include the GitHub usernames of those people. We do not read source code, issues, pull request contents or secrets. If you connect Google Workspace, the identifier and domain of that Workspace, an encrypted credential that lets us keep reading it until you disconnect, and read-only snapshots of its account list: whether each active account is enrolled in 2-Step Verification, who the administrators are and their roles, and which accounts are suspended, archived or inactive. This includes the email addresses of the customer's staff. We do not read mail, Drive files, calendars or other content.
• Communications: messages you send to us.

• To provide, secure and maintain the Service, including authenticating users and enforcing access controls.
• To process payments and manage subscriptions.
• To send service messages such as reminders, alerts, invitations and security notices.
• To keep audit records, detect abuse, and investigate security incidents.
• To respond to support and sales requests.
• To comply with legal obligations and enforce our terms.

We do not sell personal information and we do not share it for cross-context behavioral advertising. We do not use Customer Content to train artificial intelligence models.

Where the GDPR or UK GDPR applies to our role as controller, we rely on:

• performance of a contract, to provide the Service you or your organization signed up for;
• our legitimate interests in securing the Service, preventing abuse, keeping audit records and improving reliability;
• compliance with legal obligations; and
• consent, where we ask for it, which you can withdraw at any time.

We use only what is needed to run the Service: browser storage that keeps you signed in, and a cookie that remembers your sidebar preference. We do not use advertising or analytics cookies.

Our pages load fonts from Google Fonts, which means your browser sends your IP address and browser details to Google when a page loads.

We share information with the service providers below, which process it on our behalf to run the Service. Some apply only if you use the related feature.

Slack and Google receive information only when you connect them, and what they do with it is governed by your own agreement with them. GitHub is different: we only read from it, using a read-only app that you install on the repositories you choose, and you can remove it from GitHub at any time. Google Workspace is read the same way, with the approval of the Workspace's own administrator, who can revoke it at any time; how we handle that data is set out in the "Google user data" section below. When you send a document for signature, the full document is transmitted to SignWell, and the signed copy comes back and is stored with your engagement.

We may also disclose information to comply with law or legal process, to protect rights, safety and security, or in connection with a merger, financing or sale of our business, in which case we will require the recipient to honor this policy.

This section applies to CISO Doc by Valitura ("CISO Doc"), operated by Valitura, when a customer connects a Google Workspace to it. It is separate from signing in with Google or publishing to Google Drive.

• What we access. Only when a Google Workspace administrator of the customer signs in at Google and approves it, we read, with read-only permission, a list of the Workspace's user accounts and, for each account, only these fields: primary email address, whether it is suspended or archived, whether it is a super administrator or delegated administrator, whether 2-Step Verification is enrolled and enforced, the time of last sign-in and the time it was created. We also read the Workspace's admin roles and which accounts hold them. We ask Google for exactly two permissions (the read-only user directory and the read-only admin roles), plus the basic sign-in identity (openid and email) to learn which Workspace is being connected. We do not access mail, Google Drive files, calendars, contacts, names, phone numbers or any other content, and we cannot change anything in the Workspace.
• How we use it. To show the customer, and the advisors and auditors they work with, security evidence about their own Workspace: how many active accounts use 2-Step Verification, who the administrators are and their roles, and which accounts are suspended, archived or inactive. A person at the customer reviews and accepts or rejects each snapshot. We use it for nothing else.
• What we store. Counts, and lists of email addresses limited to 50 per list (administrators, accounts without 2-Step Verification, inactive accounts), saved as dated, unchangeable snapshots in the customer's workspace, and the credential that lets us keep reading until the customer disconnects.
• How we protect it. The credential is encrypted by us before it is stored, with a key held outside the database, in a table that no signed-in user can read. Data is encrypted in transit. Access to a customer's snapshots is limited by the database to members of that customer's workspace, and actions are recorded in an audit trail.
• Who we share it with. Nobody. We do not sell it, use it for advertising or share it with data brokers. It is processed only by the service providers that host CISO Doc on our behalf (listed in section 6), and is disclosed otherwise only where the law requires it. People at Valitura do not read it except where a customer asks us for support, to keep the Service secure, or to comply with law.
• No AI or machine learning. We do not use information obtained through Google APIs to develop, improve or train generalized artificial intelligence or machine learning models, and we do not send it to any AI service.
• Keeping and deleting it. The customer can disconnect at any time with the Disconnect button in CISO Doc, which revokes our access at Google and deletes our stored credential at once. They can also remove CISO Doc in the Google Admin console (Security, Access and data control, API controls) or in their Google Account's third-party access. Snapshots already collected stay in the customer's workspace as audit evidence until a workspace administrator deletes them by purging the engagement or closing the workspace. A customer can also ask us to delete Google user data by writing to [email protected]; we act on a verified request within 30 days.
• Google's Limited Use requirements. CISO Doc's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Our Service is currently hosted in the United States. If you are located elsewhere, your information will be transferred to and processed in the United States. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

We are preparing an EU region in which a workspace's database, uploaded files and sign-in data are kept in the European Union. Existing workspaces remain in the United States. When it launches, we will update this policy and our provider list.

• Account information is kept while your account is active.
• Customer Content is kept until the customer deletes it or closes the workspace. Workspace administrators can set how long archived engagements are kept and can permanently purge them once that period has passed.
• Audit records are kept for seven years and cannot be edited or deleted during that period, because they exist to support security investigations and compliance.
• When an account is deleted, we remove the profile details and disable sign-in. Audit records may keep an anonymized identifier for the actions that account performed.
• We may keep information longer where the law requires or to resolve disputes.

You can download a copy of your personal data and delete your account from your account settings in the Service. You may also email us at [email protected].

Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal information, to receive it in a portable format, and to withdraw consent. If you are in the EEA or UK you may also lodge a complaint with your local data protection authority.

If you are a California resident, you have the right to know what personal information we collect and how it is used and disclosed, to request deletion or correction, and not to be discriminated against for exercising your rights. We do not sell or share personal information as those terms are defined in California law.

We will verify your identity before acting on a request and respond within the time required by law. Requests about Customer Content should go to the customer that controls the workspace.

We use encryption in transit, encryption of stored integration credentials with a key held outside the database, per-workspace access controls enforced in the database, optional multi-factor authentication, and immutable audit records. No system is completely secure. If a breach affects your information, we will notify affected customers and authorities as the law requires.

The Service is for business use and is not directed to anyone under 18. We do not knowingly collect information from children.

We may update this policy. If changes are material we will notify account owners by email or in the Service before they take effect. The effective date above shows when it was last revised.

Valitura
1065 SW 8th, Unit 5579, Miami, FL 33130, USA
[email protected]