Privacy Policy
Last updated: 7 February 2026
Pentriarch (“we”, “us”, “our”) operates an AI-orchestrated security validation platform. This Privacy Policy sets out what personal data we collect, the purposes for which we process it, the legal bases we rely on, and the rights available to you as a data subject. For enterprise customers requiring a Data Processing Agreement (DPA), please contact privacy@pentriarch.com.
Contents
1. Scope and Controller
This policy applies to the Pentriarch website, web application, and APIs. Pentriarch acts as the data controller for personal data collected through these services.
Where Pentriarch processes data on behalf of a customer organization - for example, scan configurations and target metadata submitted by that customer - Pentriarch acts as a data processor. In those cases, the customer organization is the data controller and their own privacy policies govern that data.
This policy does not cover data that customers process within their own environments or infrastructure. That constitutes customer-controlled content and is governed by the relevant customer's own data practices.
2. Data We Collect
Account data: Name, business email address, username, organization name, job role, login credentials, and SSO identifiers.
Usage and telemetry data: IP address, device and browser information, pages visited, feature interactions, API call metadata, and timestamps.
Support communications: Messages, attachments, and metadata from support interactions, including email threads.
Billing and subscription data: Subscription plan details and invoice records. Card payment processing is handled exclusively by our payment processor - Pentriarch does not store raw card data.
Security product data: Scan configurations, target identifiers and domains you submit, execution logs, findings metadata, evidence references, and reports generated on your behalf.
We do not intentionally collect special category personal data (as defined under GDPR Article 9). If your environment or scan targets contain such data, it constitutes customer-controlled content and should be excluded from scan scope where possible.
3. Purposes of Processing
Provisioning the platform, authenticating users, and executing validation scans you initiate.
Generating security findings reports and supporting your organization's risk management function.
Improving platform reliability, performance, and usability through aggregated analytics.
Detecting and preventing abuse, fraud, unauthorized access, and misuse of the platform.
Providing customer support and responding to technical and account enquiries.
Meeting legal, regulatory, and contractual obligations applicable to Pentriarch.
4. Legal Bases (GDPR)
Where the GDPR or UK GDPR applies, we rely on the following lawful bases:
Contractual necessity (Art. 6(1)(b)): To deliver the service you have subscribed to, including account management, scan execution, and reporting.
Legitimate interests (Art. 6(1)(f)): Platform security, abuse prevention, product improvement, and fraud detection - where these interests are not overridden by your rights.
Consent (Art. 6(1)(a)): Where explicitly required for optional features, marketing communications, or non-essential cookies.
Legal obligation (Art. 6(1)(c)): Where we are required by law to retain, process, or disclose data to competent authorities.
5. Sharing and Subprocessors
We share personal data only to the extent necessary to operate and improve Pentriarch. Categories of recipients include:
Cloud hosting and infrastructure providers (e.g. compute, storage, networking).
Database and structured logging services.
Transactional email delivery and customer support tooling.
Payment processors for subscription and billing management.
Product analytics providers, used for performance monitoring and not for advertising targeting.
We do not sell, rent, or trade personal data to third parties.
Enterprise customers may request a full list of current subprocessors by contacting privacy@pentriarch.com.
6. International Transfers
Personal data may be transferred to and processed in countries outside the European Economic Area (EEA) or United Kingdom. Where such transfers occur, we implement appropriate safeguards as required by applicable law, including the use of Standard Contractual Clauses (SCCs) approved by the European Commission or the UK International Data Transfer Agreement (IDTA), as applicable. Customers requiring transfer impact assessments or supplementary documentation should contact privacy@pentriarch.com.
7. Retention
We retain personal data only for as long as necessary to fulfil the purposes described in this policy, or as required by applicable law. Our general retention practices are:
Account data: retained for the duration of the customer relationship and for a reasonable period thereafter to support dispute resolution.
Scan and findings data: retained in accordance with customer subscription terms; customers may request earlier deletion.
Audit and security logs: retained for a minimum of 12 months to support compliance, security investigations, and regulatory requirements.
Support communications: retained for a period sufficient to resolve the relevant matter and meet applicable legal obligations.
8. Security Measures
We implement technical and organizational security measures appropriate to the nature of the data and the risks involved. These include:
Encryption of data at rest and in transit using industry-standard protocols.
Role-based access controls limiting data access to authorized personnel.
Comprehensive audit logging of access and administrative actions.
Secure isolation of scan execution environments from customer data stores.
Regular internal security reviews and validation against our own platform.
No system is perfectly secure. We focus on verified, evidence-based security controls rather than unsubstantiated claims.
9. Cookies
We use strictly necessary cookies to maintain authenticated sessions and core platform functionality. We may also use analytics cookies to measure product performance and improve the user experience. Non-essential cookies are only set where consent has been obtained. You may manage or withdraw cookie consent at any time through your browser settings or our cookie preference controls.
10. Your Rights
Depending on your jurisdiction, you may hold the following rights in relation to your personal data. We will respond to verified requests within the timeframes required by applicable law (typically 30 days under GDPR):
Access: Obtain confirmation of whether we process your data and receive a copy.
Rectification: Request correction of inaccurate or incomplete personal data.
Erasure: Request deletion of your personal data where there is no overriding lawful basis for retention.
Restriction: Request that we restrict processing of your data in defined circumstances.
Portability: Receive your data in a structured, commonly used, machine-readable format.
Objection: Object to processing based on legitimate interests or for direct marketing purposes.
To exercise your rights, contact our Data Protection team at privacy@pentriarch.com. If your data was submitted through a Pentriarch customer organization, please contact that organization in the first instance as they act as the data controller for that data.
11. Children
Pentriarch is an enterprise security platform and is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have done so, we will take steps to delete that data promptly.
12. Policy Changes
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform features. We will publish any material changes on this page and update the “Last updated” date at the top. Where changes are significant, we will notify affected users through the platform or by email. Your continued use of the platform following notice of changes constitutes acceptance of the updated policy.
Data Protection Contact
For privacy enquiries, data subject rights requests, or to request a Data Processing Agreement:
privacy@pentriarch.com