Privacy Policy

1. Who is responsible for your data

• Controller: Eresus Security Ltd. Şti., İnönü Mahallesi, 1617. Cadde, Uygar Kent 1 Sitesi, 06170 Yenimahalle/Ankara, Türkiye.
• Contact for privacy questions, requests, and complaints: contact@eresussec.com.
• We have not appointed a statutory data protection officer. Privacy correspondence is handled by the team responsible for the relevant processing, and escalates to management when a request is contested.
• Where we process assessment content on behalf of a customer organization, that customer is the controller and we are the processor. Requests about that content should be directed to the customer first; we assist the customer as described in the Data Processing Addendum.

2. Scope

• This marketing site: pages, the access-request form, and the published contact addresses.
• The hosted Workbench: workspace administration, support communication, and the technical records we keep to operate and secure the service.
• Managed security (MSSP) delivery: where an MSSP uses the service on behalf of its own customers, the MSSP is the customer of record for that data relationship and its notice applies to its end customers.

3. Personal data we collect

Access requests. The form collects first name, last name, work email, company, job title, phone number, country, the requested package, and any message text. It also collects a Cloudflare Turnstile verification token and the network metadata needed to deliver and protect the submission.

Correspondence. Messages sent to our published addresses contain the information the sender includes, such as name, role, contact details, and the substance of the request.

Technical and security records. Our hosting and security providers record IP address, user agent, requested path, timestamps, and error or abuse signals for site requests. We keep workspace audit events, administrative actions, and authentication events for the hosted Workbench.

Workspace administration data. For provisioned customers: administrator and user names, work email addresses, role assignments, package entitlements, and integration configuration metadata. We do not store Workbench passwords in readable form.

Assessment content. Targets, source, findings, HTTP records, and OAST interactions are supplied by the customer and are handled under the processing terms of the customer agreement, not as our own marketing data.

We do not collect special-category data on this site, and we do not ask for it. The access-request form has no field for it. If a submission contains it anyway, we handle it only as needed to answer the request.

4. Why we process it, and on what legal basis

• To answer an access request, qualify a workspace, and take steps before a contract — performance of a contract or pre-contractual steps.
• To provide, administer, support, and secure the hosted service and the customer relationship — performance of a contract, and our legitimate interest in operating a reliable, secure service.
• To detect and block automated abuse of our forms and endpoints, including Turnstile verification — our legitimate interest in protecting the service and other users, and in preventing fraud.
• To keep records of administrative and security events, to investigate incidents, and to meet audit and compliance obligations — legal obligation, and our legitimate interest in accountability.
• To send service, security, and contractual notices — performance of a contract, and legal obligation where the notice is required by law.
• To establish, exercise, or defend legal claims — our legitimate interest in protecting our rights.
• Where we rely on consent for a specific activity, we ask separately and you can withdraw at any time without affecting processing already carried out.
• We do not sell personal data, we do not share it for cross-context behavioural advertising, and we do not use it to build advertising profiles.

5. Automated decision-making

We do not use personal data for automated decision-making that produces legal or similarly significant effects. AI-assisted features in the Workbench analyse customer assessment content to help operators triage findings; a person reviews the result before it is relied on, and no such output imposes an automatic consequence on any individual.

6. Cookies and browser storage

This site sets no advertising, analytics, or profiling cookies, and we do not run third-party analytics or tracking scripts. Cloudflare Turnstile, which protects the access-request form, is cookie-less and is not used for advertising or cross-site tracking. The details, including how to block what remains, are on the Cookie Statement page.

7. Who receives personal data

• Service providers that host the site, run the form endpoint, replace bot traffic, and carry our email — listed with their role, purpose, and data categories on the Subprocessors page.
• Professional advisers (legal, accounting, audit) where needed, under confidentiality duties.
• Authorities, regulators, or courts where the law requires disclosure, or where disclosure is needed to establish or defend a legal claim. We assess the request and disclose the minimum necessary, and we notify the affected customer unless prohibited.
• A successor entity in a merger, financing, acquisition, or asset sale, subject to this policy and to notice if the processing purpose changes.
• Within the service, access is role-scoped and tenant-scoped. A customer’s administrators control access to their own workspace data, and we do not expose one tenant’s data to another.

8. International transfers

Our providers process data in the United States and in the European Union, and the turnstile verification and email delivery described above involve transfers outside the country where you submit the request, which may include transfers outside the EEA and the UK.

Where personal data protected by the GDPR is transferred outside the EEA or the UK, we use an adequacy decision where one applies. Otherwise we are putting the European Commission Standard Contractual Clauses and, where relevant, the UK International Data Transfer Addendum in place, with a transfer risk assessment and any supplementary measures it requires. We do not assert that executed transfer instruments are already in place for every provider; ask us for the current status for your deployment. Turkish-law transfers are handled under the rules issued by the Personal Data Protection Authority.

A customer that needs a specific data-residency or transfer commitment should request it during procurement so it can be recorded in the order.

9. Retention

• Access requests and related correspondence that do not lead to a contract: kept while the commercial conversation is active and for up to 24 months afterwards, then deleted or de-identified.
• Contract, invoicing, and tax records: kept for the statutory period required by applicable law.
• Site technical and security logs: kept for a short operational window, typically up to 90 days, unless a longer period is needed for an active security investigation.
• Workspace administration and audit records: kept for the term of the subscription and then for the period set in the customer agreement or DPA, to preserve accountability.
• Assessment content: retained and deleted on the schedule in the customer agreement and DPA, including the post-termination export window.
• Where a legal hold, a dispute, or an investigation applies, we keep the relevant data until the matter closes and then delete it.

10. How we protect personal data

We use transport encryption, access control scoped to role and tenant, hashed storage for API credentials, append-only audit records for security-relevant actions, and environment separation between development and production. The technical measures, including encryption and key custody, are summarised on the Data Controls and Security pages.

No system is immune to compromise. If a personal-data breach occurs that is likely to result in a risk to rights and freedoms, we notify the affected controller and the competent supervisory authority within the time the law requires, and we support the customer response.

11. Your rights

Subject to the conditions and exemptions in applicable law, you can ask us to: confirm whether we process your personal data and provide a copy; correct inaccurate data; delete data; restrict or object to processing; obtain data you provided in a portable format; and withdraw consent where consent is the basis.

• Send a request to contact@eresussec.com. Describe the request and the data concerned so we can locate it.
• We respond within one month, and tell you if the law allows us to extend that period and why.
• We may ask for information to verify identity, and we may have to redirect a request that concerns customer-controlled assessment content to the customer as controller.
• You can complain to your local supervisory authority, or in Türkiye to the Personal Data Protection Authority (KVKK). We would prefer the chance to resolve it first.
• Turkish residents have the additional rights listed in the Turkish KVKK notice, including the right to learn whether data is processed, to request information, and to claim compensation for damage caused by unlawful processing.

12. Children

The service and this site are for organizations and professional users. They are not directed to children, and we do not knowingly collect personal data from children. If you believe a child has provided data through the site, contact us and we will delete it.

13. Changes to this policy

We update this policy when our processing, our providers, or the law changes. The effective date at the top of this page reflects the current version. For a change that materially affects how we use personal data, we give notice before the change takes effect — in-product or by email where we hold a contact address.

14. Processors we use

• Vercel Inc. — Website hosting and content delivery. Request metadata (IP address, user agent, timestamps) and the access-request form content while the message is delivered.
• Cloudflare, Inc. — Bot and abuse protection (Turnstile); optional backup object storage (R2). Turnstile signals and challenge results; backup copies of service data where R2 is used. Turnstile is cookie-less and is not used for advertising or cross-site tracking.
• Google (Google Workspace) — Business email. Email content, sender and recipient addresses, and message metadata.

15. Contact

Privacy questions, data-subject requests, and complaints: contact@eresussec.com. Security reports about our own service: security@eresussec.com.