CyberAzimut ("CyberAzimut", "we", "our") is committed to protecting the personal data of our customers, prospects and website visitors. This policy explains what we collect, why, how we use it, and the rights you have.
We collect account information you provide (name, work email, company, role), billing details processed by our payment provider, and usage telemetry from the product (logins, pages viewed, scan triggers). We also collect technical telemetry from your external attack surface (publicly resolvable DNS records, open ports, service banners, TLS certificates), which is the subject matter of the service itself. For customers on plans that include manual validation, our analysts may additionally capture notes, screenshots or observations relating to monitored assets; this information is stored and protected with the same measures as automated scan data. If you join one of our mailing lists, we collect only what section 3 describes.
To provide and operate the service, to authenticate users, to send transactional notifications (scan results, alerts), to bill, to detect abuse, and, when you opt in, to send occasional product updates. We do not sell your data, ever.
From our reports and white papers, you can join two separate lists, each with its own box, never ticked in advance: invitations to the waves of our anonymous survey, and the delivery of our annual report "Quebec Threat Landscape" when it comes out. Each list serves only its own purpose. Your subscription becomes active only once you click the link in the confirmation email we send you (double opt-in); a subscription that is not confirmed is erased automatically after 7 days. We keep only your email address, the lists you chose, the date of your consent and the date of your confirmation, the version of the wording you accepted, your language and the page you signed up from. No IP address is stored with your subscription. As with any request to our services, the connection's IP address appears in our technical security logs, which are kept for 12 months. The data of your subscription are kept until you unsubscribe, and every message carries a one-click unsubscribe link. Your address is never sold or passed on to third parties (other than the sub-processors in section 5, which host it and deliver the messages), and never used for sales prospecting.
Survey answers are anonymous: they are never linked to your email address or to your subscription to the list.
We share data with a small list of sub-processors that help us run the service: our cloud provider (AWS), our payment processor (Stripe), our email delivery service (AWS SES), and Cloudflare, whose Turnstile service protects our public forms (free trial, free checks, mailing lists) against bots and processes technical data from your browser, including your IP address, for that check. A current list is available on request.
Customer data, and the data of our mailing lists, is stored by AWS in region ca-central-1 (Montréal, Canada) by default. We retain account data for as long as you have an active subscription, plus 24 months after termination for audit purposes. Scan history can be purged on request. Mailing list data follows the retention described in section 3. Our three free public checks (email security, look-alike names and DNS) keep, for 13 months, the domain entered, the date of the check and a summary of its result (the grade when the tool gives one, and a few counters); no IP address, email address or other identifier is stored with it, and it is then deleted automatically.
If your organization chooses to, it can link its Microsoft 365 to CyberAzimut in read-only mode. This connector serves one purpose: keeping the inventory of the applications that have access to your Microsoft 365, and alerting you in the portal when a risky application is added or changed. These alerts trigger no alert email, are not passed on to Microsoft Sentinel and do not affect your score. Your organization's PDF reports, downloaded from the portal or received by email depending on your settings, may take them into account: in their counters (a compromised application counts among the critical ones) and, in the full report, as one line per open alert, without the application name or the address of its author.
Only an administrator of your Microsoft 365 can grant this access, on Microsoft's page: either directly from the portal, or with a connection link valid for 72 hours and usable once, which a member of your organization (or of your partner, if it manages your account) sends to them. We request four Microsoft Graph permissions, all read-only: Application.Read.All, DelegatedPermissionGrant.Read.All, AuditLog.Read.All and RoleManagement.Read.Directory. Nothing is ever written in your Microsoft 365.
Once an hour, we read and keep: the list of the applications that have access to your Microsoft 365 (name, publisher, and the expiry date of their secrets and certificates, never their value); the permissions granted to them; the consents given to these applications, by an administrator for the whole organization or by users (in that case, we keep the number of users, never their identity); the admin roles given to applications; and, for each addition we detect, the Microsoft sign-in address (usually the email address) of the person who made it, or the name of the application, with the time, taken from Microsoft's audit log.
We never read your email, your files, your Teams conversations or your user directory. If our application were granted, by mistake, a permission on email, files or the directory, our service would refuse to read your Microsoft 365. To make these reads, Microsoft also sends us technical data that we do not keep, for example the internal identifier of a user who consented to an application, or the IP address attached to an audit log event.
This data is kept for as long as the connection exists, by AWS in region ca-central-1 (Montréal, Canada), like other customer data. Your organization can cut the access at any time: by disconnecting Microsoft 365 in the portal, or by deleting our application in Microsoft Entra. On disconnection, the inventory, the alerts, the notes and discussions on these alerts, and the addresses taken from the audit log are erased immediately from our active data; a copy remains in our locked security backups for 30 days, then is deleted automatically in the days that follow. If you only delete our application in Entra, we can no longer read your Microsoft 365, but the data already collected stays in the portal until you disconnect. Your organization's activity log keeps a record of the connection and the disconnection (by whom, when), as for other actions taken in the portal.
The administrator who uses a connection link does not need a CyberAzimut account, and we ask them for nothing. We do not record their name, their IP address or their browser with the connection: your organization's activity log states that the connection was made through a link, and which member created it. As with any request to our services, the IP address and the browser type appear in our technical security logs, which are kept for 12 months.
Subject to applicable law (GDPR, Québec Law 25, etc.), you have the right to access, correct, port, restrict and delete your personal data. To exercise any of these rights, write to privacy@cyberazimut.com. We respond within 30 days.
All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Production access is MFA-only and audited.
Our site uses strictly necessary cookies for authentication and session management. We use one privacy-friendly analytics provider (no cross-site tracking, no advertising cookies).
We may update this policy from time to time. The "last updated" date above will change accordingly. For material changes we will notify customers by email at least 30 days before the change takes effect.
Questions? Write to privacy@cyberazimut.com.