Gizlilik Politikası (UK GDPR & DPA 2018)
ARYA AI TECHNOLOGY LTD tarafından işletilen Cyber Security House platformunun veri sorumlusu ve veri işleyen gizlilik taahhütleri.
1. Identity of Data Controller & Platform Operator
Cyber Security House is a registered commercial brand and platform operated by ARYA AI TECHNOLOGY LTD ('we', 'us', 'our'), a company registered in England and Wales under Company No. 17372232, with corporate headquarters at One Canada Square, Canary Wharf & City Cyber Center, London, United Kingdom.
We operate under the United Kingdom General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and the Privacy and Electronic Communications Regulations (PECR). Our appointed Data Protection Officer (DPO) can be contacted directly at [email protected].
2. Categories of Data Processed & Separation of Roles
We distinguish between two distinct categories of data:
Customer Account & Commercial Data: We act as a Data Controller for administrator account credentials, organizational billing details, contact submissions, and signed contract records.Customer Security Telemetry & Log Data: We act as a Data Processor under Article 28 UK GDPR on behalf of our enterprise customers. Customer telemetry (including IP addresses, server hostnames, firewall logs, Sigma detection matches, and Connected World metadata) is processed solely in accordance with documented customer instructions.3. Deterministic Pre-Inference DLP & Secret Scrubbing
A foundational principle of our AI architecture is pre-inference data loss prevention (DLP). Before any security event summary or triage request is passed to our ARYA SAI advisory model, all sensitive fields—including Bearer tokens, API credentials, passwords, session tokens, and personal identifiable information (PII)—are deterministically stripped and masked using SHA-256 cryptographic hashes.
ARYA SAI operates exclusively as an advisory co-pilot under explicit human oversight. Customer proprietary logs and security telemetry are never used to train public machine learning or foundational AI models.
4. Lawful Bases for Processing under UK GDPR
We process personal data only where a lawful basis under Article 6(1) of the UK GDPR applies:
Contractual Necessity (Article 6(1)(b)): Processing required to deliver the core Cyber Security House SaaS platform, authenticate authorized operators, and fulfill contractual SLAs.Legitimate Interests (Article 6(1)(f) & Recital 49): Processing strictly necessary for ensuring network and information security, detecting cyber attacks, isolating malicious activity, and protecting against unauthorized access.Legal Obligation (Article 6(1)(c)): Fulfilling statutory financial accounting, corporate taxation, and regulatory incident disclosure requirements under UK law.5. Sovereign Regional Data Residency
To comply with international data sovereignty regulations, customer organizations choose one of four isolated sovereign deployment regions upon provisioning: UK-LON (London, United Kingdom), EU-FRA (Frankfurt, European Union), MENA-RUH (Riyadh, Kingdom of Saudi Arabia), or APAC-TYO (Tokyo, Japan).
Customer security telemetry, audit logs, and encryption keys are strictly retained within the chosen geographical boundary. We do not engage in unauthorized cross-border transfers. Database-level PostgreSQL 16 FORCE ROW LEVEL SECURITY guarantees mathematical isolation between tenants.
6. Data Retention, Portability & Cryptographic Erasure
Operational telemetry is retained for the duration configured by the enterprise tenant (typically 30 to 365 days) and is automatically expunged following the retention horizon.
Under our zero-lock-in philosophy, customers may request a full machine-readable export of their organization's audit logs, asset registries, and compliance evidence at any time via POST /api/v1/privacy/export. Upon contractual termination, customer data is cryptographically shredded across all active tables and backup vaults within 30 days.
7. Data Subject Rights & Regulatory Oversight
Under the UK GDPR and DPA 2018, data subjects have the right to request access to, rectification of, erasure of, or restriction of processing of their personal data, as well as the right to data portability and the right to object to processing.
Requests may be submitted to [email protected] and will be addressed within 30 calendar days. If you believe your data has been handled inconsistently with UK law, you have the right to lodge a complaint with the UK supervisory authority: Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF (ico.org.uk).