Privacy Policy

1. Who we are

Cygent LLC, a limited liability company organised under the laws of the State of Delaware, USA ("Cygent", "we", "us"), provides the Cygent platform, the website at cygent.net, Cygent Academy at academy.cygent.net, and the Cygent Sensor and Cygent Explorer software (together, the "Service").

Questions about privacy: privacy@cygent.net.

2. Our role: controller or processor

• Your organisation's data in the platform (targets, assets, devices, identities, findings, tickets and everything the Service discovers for you) belongs to your organisation. For that data your organisation is the controller and Cygent acts as a processor / service provider, processing it only on your organisation's instructions.
• Account, website, billing and Academy data — Cygent is the controller.
• Self-hosted deployments — when you run Cygent on your own infrastructure, your data stays there. We receive nothing from that installation unless you send it to us (for example in a support request).

3. Information we collect

You give us

• Account data — name, work email, organisation, role and workspace membership. Passwords are stored only as salted hashes; two-factor secrets are encrypted.
• Sign in with Google — if you choose it, Google shares your name, email address and profile picture with us.
• Academy data — your learning progress, lab and quiz results and the certificates you earn.
• Support and communications — messages, tickets and feedback you send us.
• Billing data — billing contact and invoice details. Card data is handled by our payment processor; we do not store full card numbers.

The Service collects for your organisation

• External attack surface — domains, subdomains, IP addresses, open ports, certificates, technologies and vulnerability findings for the targets you add.
• Cygent Sensor (installed on devices you enrol) — device name, operating system, hardware summary, installed software and versions, running services and listening ports, security-tool status, configuration checks, logged-in and local user account names, and network neighbours (IP and MAC addresses).
• Cygent Explorer (agentless discovery) — devices found on the network ranges an administrator has explicitly authorised: IP and MAC addresses, open ports, service banners and device type.
• Connectors — data from the tools your administrator connects (for example directory accounts and groups, MFA status, endpoint and vulnerability data). Connection credentials are encrypted at rest.

Collected automatically

• Security and usage logs — IP address, browser and device information, timestamps and the actions taken in the platform (kept in a tamper-evident audit ledger).

4. How we use information

• Provide, operate, secure and improve the Service.
• Discover your assets, assess exposure, prioritise risk and track remediation.
• Authenticate users, enforce roles and permissions and detect abuse.
• Send service and security notifications you have enabled.
• Provide support, run the Academy and issue certificates.
• Bill for paid plans and meet legal obligations.

We do not sell personal data, use it for advertising, or build marketing profiles.

5. AI features

The AI assistant, AI assessments and AI-generated remediation runbooks send your request and the relevant context from your workspace to the AI model provider your administrator has configured. That provider processes the data under its own terms.

• We do not use your data to train AI models.
• Administrators can turn AI features off or choose the provider.
• AI output can be wrong — review it before acting on it.

6. Sharing and sub-processors

We share information only with:

• Infrastructure providers that host the platform.
• Email delivery providers for account and notification emails.
• Google, if you use Sign in with Google.
• The AI model provider your administrator configures (see section 5).
• Payment processors for paid plans.
• Mapbox, which serves the map tiles for the asset-location map and receives standard technical data (IP address, browser) when the map loads.
• Third-party tools you connect — data moves between Cygent and those tools as your administrator configures it, under those tools' own terms.
• Authorities, when the law requires it, and a successor in a merger or acquisition, under this policy.

A current list of sub-processors is available on request at privacy@cygent.net.

7. Cookies and local storage

We use only what the Service needs:

• An essential session cookie to keep you signed in and protect against misuse.
• Local storage in your browser to remember preferences such as language, theme and layout.

We do not use analytics, advertising or cross-site tracking cookies.

Our website (cygent.net) keeps its own visit statistics without cookies: a random identifier in your browser's local storage, and for each page you view the address, time, referring page, browser, device type, language, time zone and the IP address with the approximate location and network derived from it (using the DB-IP database, locally). We use this to understand how the site is used, to protect it from abuse and to follow up on requests you send us. Full IP addresses are deleted after 90 days; statistics without them are kept for up to 25 months. You can clear the identifier at any time by clearing your browser's site data.

If you use the website assistant, your messages are processed by our AI provider to answer you and kept with the conversation so our team can follow up and improve answers. Do not share confidential information in the chat.

8. How we protect data

Encryption in transit (TLS) and of secrets at rest, role-based access control, two-factor authentication, signed commands between the platform and the Sensor and Explorer, scanning limited to ranges you authorise, and an audit ledger of administrative actions. No system is perfectly secure; we will notify affected customers of a personal-data breach as the law requires.

9. How long we keep data

• Account data — while your account is active, then deleted within 90 days after closure.
• Workspace data — until your organisation deletes it or the subscription ends, then deleted within 90 days (backups roll off on their normal cycle).
• Audit and security logs — kept as long as needed for security, fraud prevention and legal obligations.
• Academy certificates — kept so they can be verified, unless you ask us to delete them.
• Website visit statistics — full IP addresses 90 days; anonymous statistics up to 25 months.
• Website requests, downloads and assistant conversations — as long as needed to answer and follow up, then deleted on request or after 3 years without contact.

10. International transfers

Cygent LLC is based in the United States and our providers may process data in other countries. Where the law requires it we use appropriate safeguards, such as standard contractual clauses. Self-hosted customers choose where their data lives.

11. Your rights

Depending on where you live (for example under the GDPR, the UK GDPR, the California CCPA/CPRA, Saudi Arabia's PDPL or the UAE PDPL) you may have the right to access, correct, delete or export your personal data, object to or restrict processing, and withdraw consent.

Email privacy@cygent.net. We reply within 30 days. If your request concerns data your organisation controls in its workspace, we will refer you to your organisation's administrator. You may also complain to your local data-protection authority.

12. Children's privacy

The Service is intended for professionals and learners aged 16 and over. We do not knowingly collect data from children under 16. If you believe a child has given us personal data, contact privacy@cygent.net and we will delete it.

13. Changes to this policy

We will post any update on this page with a new date. For material changes we will also notify account owners by email or in the platform before they take effect.

14. Contact

Cygent LLC — Delaware, United States Privacy: privacy@cygent.net