Privacy Policy
Your privacy is important to us. This policy explains how we collect, use, and protect your information.
Transparent
We clearly explain what data we collect and why.
Secure
Industry-standard encryption protects your data.
Your Control
You can access, export, or delete your data anytime.
1. Information We Collect
1.1 Account Information
When you create an account, we collect:
- Name and email address
- Organization name and role
- Authentication credentials (passwords are hashed, OAuth tokens)
- Billing information (processed securely through our payment provider)
1.2 Code and Infrastructure Data
To provide security scanning services across our 14 security blades, we access:
- Source code from connected repositories (read-only access) for ASPM
- Endpoint telemetry and process data for AV and EDR
- Email metadata and attachments for Mail Security
- Web traffic and URL requests for Web Gateway
- Identity provider logs for IAM integration
- Device information for MDM and DNS Security
We only access resources you explicitly connect to Pemvosec. Your data is processed for scanning and is not stored permanently unless required for displaying scan results.
1.3 Usage Data
We automatically collect:
- IP addresses and browser information
- Pages visited and features used
- Scan initiation and completion times
- API request logs
- Error reports and performance data
1.4 Cookies and Tracking
We use cookies and similar technologies for:
- Authentication and session management
- Remembering your preferences
- Analytics to improve our service
- Security and fraud prevention
2. How We Use Your Information
We use collected information to:
- Provide, maintain, and improve our security scanning services
- Process and complete transactions
- Send service-related communications and updates
- Respond to your inquiries and provide customer support
- Detect, prevent, and address security issues and abuse
- Generate aggregated, anonymized analytics to improve our platform
- Comply with legal obligations
AI Processing
Our AI features analyze your code and configurations to provide security insights and remediation suggestions. This processing is done to deliver our core service functionality. We do not use your code to train our AI models without explicit consent.
3. Information Sharing
We do not sell your personal information. We may share information with:
3.1 Service Providers
Third parties that help us operate our service, including:
- Cloud infrastructure providers (AWS, Azure)
- Payment processors
- Analytics providers
- Customer support tools
3.2 Legal Requirements
We may disclose information when required by law, such as:
- To comply with legal process or government requests
- To protect our rights, privacy, safety, or property
- To investigate fraud or security issues
3.3 Business Transfers
In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you of any change in ownership or use of your information.
4. Data Security
We implement robust security measures to protect your data:
- Encryption in transit (TLS 1.3) and at rest (AES-256)
- Regular security audits and penetration testing
- Role-based access controls for our employees
- Multi-factor authentication options
- Continuous monitoring for threats and anomalies
- SOC 2 Type II compliance
While we implement strong security measures, no system is completely secure. Please see our Security Policy for more details on our security practices.
5. Data Retention
We retain your information for as long as your account is active or as needed to provide services. Specific retention periods:
- Account data: Retained until account deletion
- Scan results: Retained for 2 years or until you delete them
- Access logs: Retained for 90 days
- Billing records: Retained for 7 years (legal requirement)
After account deletion, we will delete or anonymize your data within 30 days, except where retention is required by law.
6. Your Rights
Depending on your location, you may have the following rights:
Access
Request a copy of your personal data we hold.
Correction
Update or correct inaccurate personal data.
Deletion
Request deletion of your personal data.
Portability
Export your data in a machine-readable format.
Objection
Object to processing of your personal data.
Restriction
Request we limit how we use your data.
To exercise these rights, contact us at [email protected]. We will respond within 30 days.
7. International Data Transfers
Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place:
- Standard Contractual Clauses approved by the European Commission
- Data Processing Agreements with all service providers
- Compliance with applicable data protection laws
8. Cookie Policy
We use the following types of cookies:
| Type | Purpose | Duration |
|---|---|---|
| Essential | Authentication, security | Session |
| Functional | Preferences, settings | 1 year |
| Analytics | Usage statistics | 2 years |
You can manage cookie preferences through your browser settings. Note that disabling essential cookies may affect service functionality.
9. Children's Privacy
Our Service is not intended for children under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. For significant changes, we will also send an email notification.