Privacy policy
What we collect, and what we don’t.
Last updated September 2026. Short version: we collect what you give us to reply to an enquiry or run a free review, we keep engagement data only as long as the engagement needs, and we never sell or share any of it. Questions: hello@cyentrix.com.
1. Who we are
Cyentrix (“we”, “us”, “our”) operates cyentrix.com and provides security services to companies: cyber security consulting (cybersecurity & data protection, cloud security, cyber risk & control assurance, business continuity & DR, system & application security) and IT General Controls audit. This policy explains what personal data we collect through the website and in the course of an engagement, and how we use it.
2. What we collect on the website
Enquiries and free-review requests. When you use the contact form or request a free exposure review, we store the details you enter (name, work email, company, role, phone if given, the domain you ask us to look at, and your message) together with the page you sent it from, so we can reply and, if you go ahead, scope the work.
Free self-assessments. Your answers are processed in your browser to produce your score. Nothing is stored on our servers unless you choose to email yourself the report, in which case we keep the email address and score for up to 90 days to deliver the report and the shareable link, then delete them.
Accounts. Public registration is closed. If we set up an account for you as a client, we hold the name and email used to create it.
Comments. If you comment on a blog post, we store the name, email and message you submit plus your IP address and browser user agent (standard WordPress behaviour) for spam protection.
Server logs and analytics. Our hosting provider records standard request logs (IP address, timestamp, URL, user agent) for security and uptime; they rotate within 30 days. We may use Google Analytics or a privacy-respecting alternative to see which pages are useful. We run no advertising trackers.
3. What we collect during an engagement
To deliver a cyber review or an ITGC audit we process information about your systems: target lists, findings and the evidence behind them, audit evidence and supporting documents, and the names and contact details of the people we work with on your side. We keep the findings, the report and the evidence behind each reported item so the re-test has something to compare against. We do not keep raw scan output and we do not keep credentials; where authenticated testing is agreed, credentials are stored and used on a node inside your network, not by us. Retention is agreed in the written scope; the default is deletion after the re-test, with a copy left with you. See Security & data handling.
4. What we don’t do
- We do not sell, rent or share your data with marketers or data brokers.
- We do not send marketing sequences. We email you about your enquiry, your engagement or your account.
- We do not name you as a client, or publish anything about your environment, without written permission.
- We do not store card details on this site.
5. Who processes data for us
The website is hosted on managed infrastructure with a web application firewall. Transactional email (report delivery, enquiry acknowledgements) is sent through an email provider that receives the recipient address and message contents solely to deliver the email. We choose providers with contractual confidentiality and data-processing terms and keep the list short.
6. How long we keep data
Enquiries: while we are in conversation and for up to 24 months afterwards, so we can pick up where we left off. Self-assessment emails and scores: 90 days. Engagement data: as agreed in the scope, deleted after the re-test by default. Server logs: 30 days. You can ask us to delete anything sooner.
7. Your rights
You can ask us to access, correct, export or delete your personal data at any time by emailing hello@cyentrix.com. We respond within 30 days. If you are in the EU or UK you also have the right to complain to your supervisory authority.
8. Security
HTTPS everywhere, an enforced content-security policy, hardened hosting with a web application firewall, least-privilege access, and the same discipline we ask of our clients. No system is perfectly secure; if you find a problem, tell us and we will act on it.
9. Children
Cyentrix is intended for businesses and IT professionals. We do not knowingly collect data from anyone under 16.
10. Changes
Material changes update the date at the top of this page and, where we hold your email for an active engagement, we tell you directly.