Privacy Policy

The data controller for personal data processed in connection with the Services is:

Where Alastor processes personal data on behalf of a Customer (e.g., personal data contained within vulnerability findings or reports), Alastor acts as a data processor and the Customer acts as the data controller. The Customer's privacy obligations to their own data subjects are governed by the Customer's own privacy policy and applicable law.

We collect the following categories of personal data:

We do not knowingly collect personal data from individuals under 18 years of age. The Services are intended for enterprise use by business professionals.

We rely on the following legal bases to process personal data:

• Contractual necessity — to create and manage your account, provide the Services, and fulfil our obligations under the Terms of Service.
• Legitimate interests — to secure the Services, prevent fraud, analyse usage patterns to improve product quality, and send service-related communications. We balance these interests against your privacy rights.
• Legal obligation — to comply with applicable law, regulatory orders, or judicial process.
• Consent — for optional communications (e.g., marketing updates or product newsletters) where we ask for and obtain your explicit consent. You may withdraw consent at any time.

We use personal data to:

• Provision, operate, maintain, and secure the Services.
• Authenticate users and enforce access-control policies.
• Send transactional communications (account alerts, security notifications, finding updates).
• Process invoices and manage subscription billing.
• Respond to support requests and resolve disputes.
• Conduct internal analytics to improve the platform's security and usability.
• Comply with applicable legal and regulatory obligations, including responding to lawful requests from Indian government or law-enforcement authorities.
• Detect, investigate, and remediate security incidents affecting the Services.

We will not use Customer Data to train, fine-tune, or improve AI or machine-learning models without your explicit written consent.

We do not sell personal data. We may share it with:

• Service providers acting as sub-processors (cloud infrastructure, email delivery, payment processing, authentication) under contractual data-protection obligations that are no less protective than this Policy.
• Professional advisors (lawyers, auditors) bound by confidentiality.
• Law enforcement or regulators when required by applicable law, valid legal process, or to protect the rights, property, or safety of Alastor, its customers, or the public. Where legally permissible, we will notify you before disclosing.
• Acquirers in the event of a merger, acquisition, or asset sale, provided the acquirer agrees to honour this Policy or provides you with a materially equivalent policy.

A current list of our sub-processors is available on request at privacy@alastorinfosec.com.

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by law.

Deletion is performed via cryptographic erasure or secure overwrite in accordance with NIST SP 800-88 guidelines. Upon request, we will provide a written confirmation of deletion.

Alastor implements technical and organisational security measures appropriate to the risk of processing, including:

• Encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256).
• Role-based access controls and least-privilege enforcement for all internal systems.
• Multi-factor authentication required for all Alastor staff accessing production systems.
• Continuous vulnerability scanning and periodic penetration testing of our own infrastructure.
• Formal incident-response procedures with defined escalation paths and Customer notification obligations.
• Annual security-awareness training for all personnel with access to personal data.
• SOC 2 Type II audit (in progress); interim findings available to Customers under NDA.

Notwithstanding the above, no security measure is infallible. In the event of a personal data breach, Alastor will notify affected Customers without undue delay and in any case within 72 hours of becoming aware of the breach, in accordance with applicable law.

Alastor's primary infrastructure is hosted within India. Where data is transferred to sub-processors located outside India (e.g., authentication or email service providers based in the United States or the European Union), we ensure that adequate safeguards are in place, including Standard Contractual Clauses approved by the relevant supervisory authority or equivalent mechanisms.

For Customers subject to GDPR, data transfers outside the EEA are governed by Standard Contractual Clauses (Module 2: Controller to Processor) incorporated by reference into the Data Processing Agreement and available on request.

Depending on your jurisdiction, you may have the following rights with respect to your personal data:

To exercise any of these rights, submit a request to privacy@alastorinfosec.com. We will respond within 30 days. We may require identity verification before processing the request. If you are dissatisfied with our response, you have the right to lodge a complaint with the relevant data-protection authority in your jurisdiction.

The Pulse platform uses strictly necessary session cookies to maintain authenticated sessions and prevent cross-site request forgery. We do not deploy third-party advertising trackers or behavioural profiling cookies. We may use first-party analytics (e.g., Vercel Analytics) to collect aggregated, anonymised usage data to improve platform performance.

You may configure your browser to reject all cookies; however, session cookies are required for the authenticated portions of the Services to function.

The Services are not directed at, and we do not knowingly collect personal data from, children under the age of 18. If we become aware that we have inadvertently collected personal data from a child, we will promptly delete it. If you believe we have collected such data, please contact us at privacy@alastorinfosec.com.

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. Material changes will be communicated by email or in-product notice at least fourteen (14) days before the effective date. We maintain a version history and prior versions are available on request. Continued use of the Services after the revised Policy takes effect constitutes acceptance of the changes.

For questions, concerns, or to exercise your rights under this Policy, contact our designated Privacy Officer:

In compliance with the Information Technology Act 2000 and rules thereunder, the name and contact details of the Grievance Officer shall be published and shall be accessible to users of the Services.