Privacy Policy

Effective date: June 2026  •  Contact: [email protected]

This Privacy Policy explains how VXSec handles information for website visitors, scope checks, diagnostics, cleanup sprints, partner delivery, and related communications. Project-specific agreements may add to or override this policy for a specific engagement.

1. Information We Collect

We collect only what is reasonably needed to respond to inquiries, scope work, deliver services, maintain records, and protect our business.

• Contact information: name, email, company, role, phone number, and information submitted by email, booking tools, or a contact form if one is used.
• Scope check information: systems in use, user counts, tool lists, cloud account context, SaaS stack, AI tool usage, contractor patterns, offboarding concerns, and known cleanup issues.
• Audit and implementation artifacts: screenshots, SaaS exports, cloud exports, AI tool inventories, access lists, admin role lists, audit logs, billing exports, workflow notes, and report drafts.
• Access information: temporary credentials, delegated access details, role assignments, screen-share information, or access instructions provided for a scoped engagement.
• Business records: proposals, statements of work, invoices, payment status, project notes, approvals, and correspondence.

2. How We Use Information

• To respond to inquiries and schedule scope checks.
• To evaluate fit, scope systems, price work, and prepare proposals.
• To deliver fixed-scope diagnostics, access reviews, SaaS/cloud hygiene reviews, AI tool access reviews, implementation sprints, and partner delivery.
• To draft reports, findings tables, implementation roadmaps, approval lists, and documentation.
• To maintain billing, tax, legal, and business records.
• To protect systems, prevent misuse, and comply with applicable obligations.

Client-controlled data remains client data. VXSec does not sell client data or use client data for advertising.

3. AI-Assisted Internal Drafting

VXSec may use AI-assisted tools for internal drafting, editing, summarizing, or organizing work product when appropriate. We do not use client data to train models. Where AI-assisted tools are used, the goal is drafting support; VXSec remains responsible for reviewing deliverables before they are sent.

4. Sharing and Subprocessors

We share information only as needed to operate the business, deliver the agreed services, or comply with law. This may include scheduling tools, email and document tools, payment processors, cloud storage, security tools, subcontractors, and delivery partners. Examples may include Calendly, Google Workspace, Stripe, cloud hosting or storage providers, and approved project partners.

We do not sell personal information. Subprocessors and partners are expected to handle information only for the purpose of supporting the agreed work.

5. Access, Credentials, and Client Systems

VXSec prefers exports, read-only access, screen share, or least-privilege access where practical. Temporary admin or implementation access may be needed for approved cleanup work. Access should be removed after the engagement or when it is no longer needed unless a project-specific agreement says otherwise.

6. Retention and Deletion

Retention depends on the type of information, project needs, legal requirements, and client instructions.

• Contact and billing records: retained as needed for business, tax, and legal records.
• Reports and project documentation: retained for reference and quality purposes unless deletion is requested or a project agreement sets a different period.
• Temporary access credentials: deleted or revoked after delivery or when no longer needed.
• Exports, screenshots, and audit artifacts: retained only as long as needed for the project, support period, legal record, or agreed follow-up.

You may request deletion of project artifacts by emailing [email protected]. Some records may need to be retained for legal, accounting, dispute, or legitimate business reasons.

7. Security Measures

VXSec uses practical security measures such as access controls, least-privilege access, password management, secure storage, encrypted transport where available, limited access to client artifacts, and removal of temporary access after work is complete. No system or transmission method is perfectly secure, and third-party platforms may have their own limitations.

8. Website Data

The VXSec website does not use advertising pixels or tracking scripts. Server logs or hosting providers may process basic technical information such as IP address, browser, requested page, timestamp, and referrer for security, debugging, and site operation.

9. International Processing

VXSec is based in Ontario, Canada. Some tools, subprocessors, clients, or project partners may process data in Canada, the United States, or other countries depending on the service used.

10. Your Requests

You may contact VXSec to request access, correction, deletion, or information about how your data is handled. We may need to verify identity and confirm authority before acting on requests involving client systems or project artifacts.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Updated versions will be posted on this page. Project-specific agreements may continue to control for active work where they differ from this policy.

12. Contact

For privacy questions, requests, or concerns, contact us at:

VXSec
Ontario, Canada
[email protected]

We will respond to privacy inquiries within 30 days.