Privacy Policy
Last Updated: 01/01/2026
This Product Privacy Policy explains how Defendermate, Inc. (“Defendermate,” “we,” “us,” or “our”) processes information in connection with the Defendermate software platform, applications, APIs, and related services (collectively, the “Service”).
This policy applies to product usage and governs how data is handled when users access Free Services or Paid Services. It does not apply to general visitors to the Defendermate marketing website.
1. Roles and Scope
Defendermate operates as both a data controller and a data processor, depending on the type of information processed.
- For Customer Data processed through Paid Services, Customer acts as the data controller and Defendermate acts as the data processor.
- For limited Customer Data voluntarily uploaded for ad hoc analysis, Defendermate acts as a data processor where applicable.
- For account administration, authentication, billing, and support information, Defendermate acts as a data controller.
Processing of Customer Data through Paid Services is further governed by an applicable Data Processing Agreement.
2. Information Processed
2.1 Account and User Information
We process information necessary to create and manage accounts, including:
- Name
- Email address
- Organization name
- Role or job title
- Authentication and access credentials
- Support communications
2.2 Public Threat Intelligence and External Signals
The Service processes:
- Publicly available threat intelligence
- Licensed third-party vulnerability, exploit, and threat data
- External security signals and metadata
This data does not originate from Customer environments.
2.3 Customer Data Submitted for Ad Hoc Analysis
As part of Free Services, users may voluntarily upload limited Customer Data for ad hoc analysis. This may include:
- Vulnerability lists
- Configuration artifacts
- Exported scan results
- Other security-related data explicitly provided by the user
Ad hoc uploads:
- Are user-initiated
- Are not continuously ingested or monitored
- Do not create ongoing integration with Customer environments
Users are responsible for ensuring they have authorization to upload any such data.
2.4 Customer Environment Data (Paid Services)
As part of Paid Services, Defendermate may process Customer Data such as:
- Cloud and infrastructure metadata
- Asset identifiers and configurations
- Identity and access relationships
- Vulnerabilities, misconfigurations, and exposure data
- Security logs and contextual metadata
This data is processed only with Customer authorization and pursuant to an Order Form.
2.5 Operational and Usage Data
We process limited technical data necessary to operate and secure the Service, including:
- IP address
- Device and browser information
- Usage metrics and feature interaction data
- System logs for reliability, debugging, and security
3. Purposes of Processing
Defendermate processes information to:
- Provide, operate, and maintain the Service
- Perform analytics and prioritization based on external threat intelligence and Customer Data
- Enable ad hoc analysis requested by users
- Secure the platform and prevent abuse
- Provide customer support
- Comply with legal obligations
Defendermate does not sell Customer Data or use Customer Data for advertising purposes.
4. Legal Bases for Processing
Where applicable, Defendermate relies on the following legal bases:
- Performance of a contract
- Legitimate interests in operating and securing the Service
- Compliance with legal obligations
- Customer instructions, where Defendermate acts as a data processor
5. Data Retention
Data retention depends on the type of Service used.
5.1 Free Services
- Public threat intelligence is retained according to licensing terms.
- Ad hoc Customer Data uploads may be retained temporarily to perform requested analysis and may be deleted automatically after processing or after a limited retention period.
5.2 Paid Services
- Customer Data is retained for the duration of the subscription and handled according to the applicable Order Form and Data Processing Agreement.
- Upon termination, Customer Data is deleted or returned in accordance with contractual obligations, subject to legal requirements.
6. Data Sharing and Subprocessors
Defendermate may share data with subprocessors that support the operation of the Service, such as:
- Cloud infrastructure providers
- Monitoring and logging services
- Customer support platforms
All subprocessors are bound by confidentiality and data protection obligations consistent with this policy.
Defendermate does not disclose Customer Data to third parties for marketing purposes.
7. International Data Transfers
Data may be processed in the United States and other jurisdictions.
Where required by law, Defendermate uses appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms.
8. Security Measures
Defendermate implements reasonable administrative, technical, and organizational safeguards designed to protect information, including:
- Encryption in transit and at rest where appropriate
- Access controls and least-privilege enforcement
- Logging and monitoring
- Incident response procedures
No system can be guaranteed to be completely secure.
9. Data Subject Rights
Depending on jurisdiction, individuals may have rights to:
- Access personal information
- Correct inaccurate information
- Request deletion or restriction of processing
- Object to certain processing activities
For Customer Data processed on behalf of a Customer, requests should be directed to the Customer as the data controller.
10. Children's Privacy
The Service is not intended for individuals under 18. Defendermate does not knowingly process personal data of children.
11. Changes to This Policy
Defendermate may update this Product Privacy Policy from time to time. Material changes will be communicated through the Service or other appropriate means.
Continued use of the Service constitutes acceptance of the updated policy.