Privacy Policy

1. Introduction

After A Breach ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our incident response and cybersecurity services, visit our website, or otherwise interact with us.

We understand that as a cybersecurity company handling sensitive incident data, we hold ourselves to the highest standards of data protection and confidentiality.

2. Information We Collect

2.1 Information You Provide

We collect information that you provide directly to us:

• Contact Information: Name, email address, phone number, company name, job title
• Emergency Contact: Information provided when you call our emergency hotline
• Incident Data: Information about security incidents, affected systems, and breach details
• Account Information: Credentials and preferences if you create an account
• Payment Information: Billing details and payment method information

2.2 Information Collected During Engagements

During incident response and forensic engagements, we may access:

• System logs, network traffic, and security event data
• Forensic images of affected systems
• User account information and access logs
• Malware samples and indicators of compromise
• Email communications related to the incident
• Any other data necessary to investigate and remediate the incident

2.3 Information Collected Automatically

When you visit our website, we automatically collect:

• IP address and browser type
• Device information and operating system
• Pages visited and time spent on our site
• Referring website and navigation patterns
• Cookies and similar tracking technologies

3. How We Use Your Information

We use the information we collect to:

• Provide incident response and cybersecurity services
• Investigate and remediate security incidents
• Communicate with you about our services and your incidents
• Process payments and maintain financial records
• Comply with legal obligations and regulatory requirements
• Improve our services and develop new offerings
• Conduct research and analysis (using anonymized data)
• Send service updates and security advisories
• Respond to your inquiries and support requests

4. How We Share Your Information

We maintain strict confidentiality but may share information in limited circumstances:

4.1 With Your Consent

We will share information when you explicitly authorize us to do so.

4.2 Service Providers

We may share information with trusted third-party service providers who assist us in delivering our services, such as:

• Cloud infrastructure providers
• Forensic tool vendors
• Payment processors
• Professional consultants (legal, accounting)

All service providers are bound by confidentiality agreements and data protection requirements.

4.3 Legal Requirements

We may disclose information when required by law, court order, subpoena, or to:

• Comply with legal processes
• Protect our rights and property
• Prevent fraud or security threats
• Cooperate with law enforcement (where legally required)

4.4 Cyber Insurance Providers

With your authorization, we share information with cyber insurance providers to facilitate coverage and claims processing.

4.5 Anonymized Data

We may share anonymized, aggregated data for research, case studies, or threat intelligence purposes. This data cannot be used to identify you or your organization.

5. Data Security

We implement industry-leading security measures to protect your information:

• End-to-end encryption for data in transit and at rest
• Multi-factor authentication for system access
• Regular security audits and penetration testing
• Strict access controls and need-to-know principles
• Secure evidence handling and chain of custody procedures
• Employee background checks and security training
• Incident response and data breach notification procedures

While we take extensive precautions, no method of transmission or storage is 100% secure. We cannot guarantee absolute security but maintain vigilance and continuous improvement.

6. Data Retention

We retain your information:

• For as long as necessary to provide our services
• As required by legal, regulatory, or contractual obligations
• For evidence preservation (typically 7 years for incident data)
• Until you request deletion (subject to legal requirements)

When data is no longer needed, we securely delete or anonymize it in accordance with industry best practices.

7. Your Rights and Choices

Depending on your location, you may have rights regarding your personal information:

• Access: Request a copy of your personal information
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your data (subject to retention requirements)
• Portability: Receive your data in a portable format
• Opt-out: Unsubscribe from marketing communications
• Object: Object to certain processing of your data

To exercise these rights, please contact us at privacy@afterabreach.com

8. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your website experience. You can control cookies through your browser settings. Note that disabling cookies may limit website functionality.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place for international transfers, including:

• Standard contractual clauses
• Data processing agreements
• Adequacy determinations
• Client-specific data residency requirements

10. Children's Privacy

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal information, we will delete it immediately.

11. Changes to This Privacy Policy

We may update this Privacy Policy periodically. We will notify you of material changes by posting the updated policy on our website and updating the "Last updated" date. Your continued use of our services after changes are posted constitutes acceptance of the revised policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices:

• Email: privacy@afterabreach.com
• Data Protection Officer: dpo@afterabreach.com