How SOC Bot handles personal data

Account information provided by your organization when it creates your account, such as your name, work email address, and role, together with the credentials and authentication settings needed to sign you in.

Usage and security records generated while you use the service, such as sign-in activity, session details, the network address and browser you connect from, the items you view, and a record of the actions you take. Review and attestation actions are recorded with the identity of the person who performed them, because they are compliance records.

Content your organization uploads, including audit reports and supporting evidence, and the analysis derived from it. Uploaded documents may contain the names of people mentioned in them. Your organization controls this content.

Enquiry details if you contact us or request access through this website, such as your name, email address, company, and anything you include in your message.

To provide and support the service your organization subscribed to, including authentication, keeping each organization’s data separate, analyzing the documents your organization uploads, and supporting its review and approval workflow. To keep the service secure and to investigate misuse or incidents. To respond to your enquiries. To meet our legal and contractual obligations.

We do not sell personal data, use it for advertising, or run behavioral advertising or analytics trackers on the service or this site.

We share personal data only with service providers that help us operate the service, each bound by contract to use it solely for that purpose:

• AI model providers that analyze the documents your organization uploads. Your organization chooses its provider from the options we support, and may use its own provider account or one we manage.
• Cloud infrastructure providers for hosting and encrypted backup storage.
• Email delivery providers for invitations, account notices, and notifications.
• A bot-protection service on our public request form.

The current list of providers and their regions is published on our Trust page. We may also disclose personal data where the law requires it, and we may transfer a customer’s data between that customer’s own organizations at its request.

• Account information: for as long as your account exists. When you leave your organization, its administrator can have your account anonymized.
• Compliance records such as the audit trail and review and attestation records: for the life of your organization’s subscription, because they must remain attributable and unaltered to serve as evidence. The identity of the acting reviewer is retained even after the account is anonymized.
• Uploaded content: until your organization deletes it. Content referenced by an approval record is retained with that record.
• Enquiry details: until we have responded and no longer need them, or sooner on request.
• Operational logs and backups: for limited periods needed for security and recovery, after which they are removed. Deleted records may persist in backups until those backups expire.

Depending on where you live, you may have the right to access, correct, export, or erase your personal data, or to object to or restrict how it is used.

• If you use SOC Bot through your employer or another organization, contact that organization’s administrator. SOC Bot processes your data on its behalf, and it can view, correct, export, or anonymize your account.
• If you contacted us directly or requested access, email hello@socbot.cyberblacksec.com.

You may also have the right to lodge a complaint with your local data protection authority.

We use only the cookies strictly necessary to keep you signed in and to protect the service. We do not use advertising or analytics cookies.

We protect personal data with encryption in transit and at rest for sensitive material, strict separation between customer organizations, access controls, and monitoring. An overview of our security program is on the Trust page. If we confirm a security incident involving your organization’s data, we will notify that organization’s administrators within 72 hours of confirming it, with what we know, what was affected, and what we are doing about it.

We will update this notice when our practices change and show the effective date at the top. Material changes will be communicated to organization administrators.