Privacy Policy

1Overview

This Privacy Policy describes how Astrolabe Security Inc. ("Astrolabe," "we," "us," or "our") collects, uses, discloses, and protects information that applies to our security testing platform, DAST Scanner, PTaaS platform, API Security Platform, Cloud Vulnerability Scanner, Mobile App Pentesting service, and all associated websites, applications, and services (collectively, the "Services").

By accessing or using our Services, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this Privacy Policy, please do not access or use our Services.

Astrolabe is incorporated in the State of Texas, United States, with its headquarters at 553 Sierra Ridge, Lavon, TX 75166. For the purposes of the GDPR, Astrolabe Security Inc. is the data controller for personal data processed under this policy.

Scope

This Privacy Policy applies to:

• Visitors to our website (astrolabe-security.com and related domains)
• Customers and users of our security testing platform and products
• Prospective customers who contact us for information or demonstrations
• Partners, resellers, and affiliates
• Job applicants and career page visitors

This policy does not apply to third-party websites, services, or applications that may be linked from our Services. We encourage you to review the privacy policies of any third-party services you access.

2Information We Collect

We collect information in three ways: information you provide directly, information we collect automatically, and information from third parties.

2.1 Information You Provide Directly

2.2 Information Collected Automatically

When you use our Services, we automatically collect certain technical information:

• Log data: IP address, browser type, operating system, referring URLs, pages visited, access times, and actions taken within our platform
• Device information: Device type, browser version, screen resolution, language settings
• Usage data: Features used, scan configurations, report generation, API calls, and session duration
• Performance data: Page load times, error rates, and platform performance metrics
• Cookie data: See our Cookie Policy (Section 9) for full details

2.3 Information from Third Parties

We may receive information about you from:

• OAuth providers: GitHub, Google, or Microsoft when you use social login
• Payment processors: Stripe provides transaction confirmation and fraud signals (we do not store full card numbers)
• Analytics services: Aggregated, anonymized usage data from third-party analytics platforms
• Marketing platforms: Contact information from B2B data enrichment services (only for sales outreach)
• Partners & resellers: Account details shared by authorized Astrolabe partners

3How We Use Your Data

We use the information we collect to provide, maintain, and improve our Services, communicate with you, ensure security, and comply with legal obligations.

4Legal Basis for Processing (GDPR)

For individuals in the European Economic Area (EEA), United Kingdom, and Switzerland, we process personal data only when we have a valid legal basis under the GDPR. Our legal bases are:

• Contract performance (Art. 6(1)(b)): Processing necessary to provide the Services you've contracted us for — running security scans, generating reports, managing your account, and processing payments.
• Legitimate interests (Art. 6(1)(f)): Processing for our legitimate business interests, such as improving our products, preventing fraud, ensuring platform security, and sending service-related communications. We always balance these interests against your privacy rights.
• Legal obligation (Art. 6(1)(c)): Processing required to comply with applicable laws, including tax laws, financial regulations, and law enforcement requests.
• Consent (Art. 6(1)(a)): Processing based on your explicit consent, such as marketing emails and optional analytics cookies. You may withdraw consent at any time without affecting prior processing.

For special category data (if any), we rely on explicit consent (Art. 9(2)(a)) or another applicable exemption under Article 9 GDPR.

5Data Sharing & Disclosure

We share personal data with third parties only in the limited circumstances described below. We never sell personal data.

5.1 Service Providers (Processors)

We engage trusted third-party service providers who process data on our behalf under strict data processing agreements:

5.2 Legal Disclosures

We may disclose your information if required by law, court order, or governmental authority, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others. We will notify you of such disclosures where legally permissible.

5.3 Business Transfers

If Astrolabe is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will provide notice and ensure any successor entity is bound by obligations consistent with this Privacy Policy.

6Data Retention

We retain personal data only for as long as necessary to fulfill the purposes described in this policy, comply with legal obligations, resolve disputes, and enforce our agreements.

When data reaches the end of its retention period, we securely delete or anonymize it. You may request earlier deletion of your data (subject to legal retention requirements) as described in Section 7.

7Your Privacy Rights

Depending on your location, you have the following rights regarding your personal data. We respond to all verified requests within 30 days (extendable to 90 days for complex requests).

To exercise any of these rights, contact us at privacy@astdb.com. We will verify your identity before processing requests. We do not charge fees for rights requests unless they are manifestly unfounded or excessive.

8Security Measures

As a security company, protecting your data is fundamental to who we are. We implement industry-leading technical and organizational security measures.

Technical Safeguards

• Encryption in transit: All data transmission uses TLS 1.3 with certificate pinning on mobile applications
• Encryption at rest: All stored data encrypted with AES-256. Scan results and security reports use envelope encryption with customer-managed keys available on Enterprise plans
• Access controls: Role-based access control (RBAC), multi-factor authentication enforced for all staff, least-privilege access principles
• Infrastructure security: VPC network isolation, private subnets for data stores, WAF, DDoS protection, and automated vulnerability scanning on our own infrastructure
• Secrets management: All credentials stored in AWS Secrets Manager with automatic rotation. No credentials in code or configuration files
• Penetration testing: We pentest our own platform quarterly using Astrolabe's tools — we eat our own cooking

Organizational Safeguards

• Security awareness training for all staff upon onboarding and quarterly thereafter
• Background checks for employees with access to customer data
• Formal incident response plan with defined escalation and notification procedures
• SOC 2 Type II certified — annual third-party audit of security controls
• ISO 27001 certified information security management system

Data Breach Notification

In the event of a data breach that affects your personal data, we will notify you within 72 hours of becoming aware of the breach (as required by GDPR), and within the timeframes required by other applicable laws. Notification will include the nature of the breach, data affected, likely consequences, and measures taken.

9Cookie Policy

We use cookies and similar tracking technologies to operate our Services, analyze usage patterns, and personalize your experience. You can control cookie preferences through our cookie consent banner or your browser settings.

To manage your cookie preferences, click "Cookie Settings" in the footer, or use your browser's privacy settings to block or delete cookies. Note that blocking certain cookies may affect platform functionality.

10International Data Transfers

Astrolabe is headquartered in the United States. If you are located outside the US, your data may be transferred to, stored, and processed in the United States or other countries where our service providers operate.

For transfers from the EEA, UK, or Switzerland to the United States, we rely on the following appropriate safeguards:

• EU-US Data Privacy Framework (DPF): Astrolabe is certified under the EU-US Data Privacy Framework for transfers to the United States
• Standard Contractual Clauses (SCCs): We use the European Commission's approved SCCs (2021 Implementing Decision) for transfers to third-party processors
• UK International Data Transfer Agreements (IDTAs): Used for transfers from the United Kingdom
• Adequacy decisions: Where available, we transfer data to countries with an EU Commission adequacy decision

You can request a copy of the safeguards we use for international transfers by contacting privacy@astdb.com.

11Children's Privacy

Our Services are not directed to individuals under the age of 16 (or the relevant age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child under 16, we will take immediate steps to delete that information.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us at privacy@astdb.com and we will promptly delete it.

12California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) grant you specific rights regarding your personal information.

California-Specific Rights

• Right to Know: Request disclosure of the personal information we've collected about you over the past 12 months, including categories, sources, business purposes, and third parties it's shared with
• Right to Delete: Request deletion of personal information we've collected about you, subject to certain exceptions
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out of Sale or Sharing: We do not sell or share personal information for cross-context behavioral advertising. No opt-out is necessary, but you can contact us to confirm this
• Right to Limit Use of Sensitive Personal Information: Request that we limit use of your sensitive personal information to necessary service provision
• Right to Non-Discrimination: We will not discriminate against you for exercising any CCPA/CPRA right

Categories of Personal Information Collected (last 12 months)

Under the CCPA, we have collected the following categories of personal information: Identifiers (name, email, IP address), commercial information (subscription and billing records), internet activity (usage logs, cookies), professional information (job title, company), and inferences drawn from this information for our security recommendations.

To submit a California privacy rights request, contact us at privacy@astdb.com or call +1 (972) 379-8459. We will verify your identity before processing your request and respond within 45 days.

13Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational, legal, or regulatory reasons.

When we make material changes, we will:

• Post the updated policy on this page with a new "Last Updated" date at the top
• Send an email notification to registered account holders at least 14 days before material changes take effect
• Display an in-platform banner notification for active users
• For significant changes affecting your rights or our data use practices, request your acknowledgment or re-consent where required

We encourage you to review this Privacy Policy periodically. Your continued use of our Services after the effective date of the revised policy constitutes your acceptance of the changes.

14Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us through any of the following channels. We respond to all privacy inquiries within 5 business days.

Data Protection Officer

For GDPR-related inquiries, you may contact our designated Data Protection Officer directly at dpo@astdb.com. Our DPO is available to assist with questions about processing lawfulness, rights requests, and supervisory authority complaints.

EU Representative

For individuals in the European Economic Area, our EU representative for GDPR purposes can be reached at eu-rep@astdb.com.

Supervisory Authority

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority. For a list of EU DPAs, visit the EDPB website. UK residents may contact the ICO.