Privacy notice

Who we are

This website is operated by Agent Trust Cloud, registered at 7228 Wadebridge Drive, Canton, Michigan 48187, United States. For anything in this notice, including requests about your data, contact [email protected].

What you give us

The only place this site asks for personal data is the pilot request form. The other is “Save my result” on the free tools, described below.

The free-text field is yours to fill as you choose. The form asks you not to include credentials, customer records or production data, and we would rather you did not — anything you type there is sent onward and stored in the mailbox that receives it.

Saving a free tool's result

The free tools on this site and on airiskassessmenttool.com, securityawarenesskit.com, incidentresponseplantemplate.com work in your browser and send nothing on their own. If you choose “Save my result”, type your email address and tick the consent box (it is never ticked for you), we receive your email address, which tool you used, a short summary of the result — its headline, level, score and a few lines, not your individual answers or anything you pasted — the consent wording you agreed to with its version, and the time.

We use it for one purpose: to email you one fixed message with a link, and to keep the result until you claim it. Saving creates no account and changes nothing in one that exists. The result is added to a workspace only after you sign in with that address, verified by our sign-in provider, and accept it; if you own no workspace, a free one is created then. When you accept, a result from one of the agent tools that names an agent also becomes an entry in that workspace’s agent inventory — the name you gave, a risk tier taken from the result’s level, and the result’s lines as findings — marked as coming from the result, and it is then workspace data like any other. It is never added to a workspace you did not accept it into, and it does not replace an agent already there. An unclaimed result is deleted after 72 hours. A save sends no other email. To limit abuse we keep, with each save, a keyed hash of your IP address (never the address itself) and a normalised form of your email address, and count recent saves.

What is collected automatically

Our hosting provider records ordinary web server logs for every request: source IP address, user agent, the path requested, the response status and a timestamp. We use these to operate and debug the site.

When you submit the form, your IP address is also used in memory to rate limit submissions, so one network cannot flood the form. That counter is not written to storage and is discarded when it expires or the server restarts.

The form records how long the page was open before you submitted it. If that is unusually short — which is normally automated abuse, occasionally a person using autofill — the submission is still delivered, with a note attached so a human can judge it. The form also contains a field hidden from view; if it is filled in, the submission is treated as automated and is discarded rather than delivered.

What is stored and logged

Every contact submission is stored in our database before a notification is attempted, together with its reference, contact details, message, source page and delivery state. If notification fails, the error is recorded on that row and shown in the owner queue so the enquiry remains available for follow-up. Application logs record the reference and notification status without duplicating the message. Those logs are retained by our hosting provider for its standard log retention period.

Analytics, and the choice you are given

The public pages of this site can report anonymous usage to Google Analytics and Microsoft Clarity. The signed-in and private areas never do: the console, the workspace, sign-in, onboarding, the purchase confirmation and the administrator page. Nothing is sent and no analytics code is loaded until you choose to allow it. Before that choice, and for the whole life of the visit if you decline, there is no Google or Microsoft request and no analytics cookie.

If you allow it, Google Analytics loads from googletagmanager.com and sets its own cookies in your browser. We switch off advertising storage, Google Signals and ad personalisation, so the data is not used to build an advertising profile of you, and we send a deliberately reduced page context — the page path, no query string, and only the origin of wherever you came from.

If you allow it, Microsoft Clarity also loads from clarity.ms and records clicks and scrolling so we can fix pages that are hard to use. All text, including anything you type, is masked in your browser, and it stops in the private areas.

You are asked once, with two buttons: Essential only and Allow analytics. Either answer is remembered in your browser's local storage, under public_analytics_consent_v1, so you are not asked again. That single value is the one thing this site stores in your browser without asking, and it exists only to record that you were asked.

To change your mind, use the Analytics preferences control at the foot of the page — it reopens the same choice, and choosing Essential only stops any further reporting immediately. Clearing site data for this domain also removes the stored answer, and you will be asked once more.

What we deliberately do not do

Unless you allow analytics, the public pages set no cookies, run no analytics and make no third-party requests for measurement, and the private areas never do, whatever you choose. Fonts are served from this domain rather than a font CDN. There is no advertising anywhere on the site, no tracking pixel, no profiling and no automated decision-making about you.

Who else processes it

We do not sell personal data or share it for advertising. We use these providers to run the site:

• Railway — Hosting and server logs. The service runs in a United States region.
• Google Analytics — Anonymous usage measurement on the public pages, and only after you allow it. Advertising storage, Google Signals and ad personalisation are switched off.
• Microsoft Clarity — Masked session replay on the public pages, only after you allow analytics.
• Stripe — Takes payment. Card details go to Stripe, never to us; we receive the purchase, billing name, email and tax details.
• Cloudflare — Delivers the site and blocks abuse, which processes your IP address.
• Microsoft 365 — Delivers notification email through Microsoft Graph for a form submission, and therefore processes what you submitted. It uses the same tenant that hosts the Agent Trust Cloud mailbox.

If you are outside the United States, submitting the form means your data is transferred there. Where applicable law requires an international-transfer safeguard, we and our providers use the contractual or other lawful mechanism that applies to that transfer.

How long we keep it

Enquiries are kept for 24 months after the most recent substantive contact and then deleted, unless the conversation has become a customer relationship with its own record. Server logs follow our hosting provider's retention period.

Your rights

Depending on where you live, you may have the right to ask for a copy of the data we hold about you, to have it corrected or deleted, to object to or restrict how we use it, and to complain to a data protection regulator. Write to [email protected] and we will respond. You never need an account to exercise these rights, and we will not treat you differently for doing so.

Security

The site is served over HTTPS with a restrictive content security policy. Form submissions are validated and rate limited on the server. Credentials for delivery providers are held as environment variables and are not in the source code. That said, no transmission over the internet is completely secure, and the form is not the place for sensitive material.

Children

This is a business-to-business site and is not directed at children. We do not knowingly collect data from anyone under 16.

Changes

If this notice changes materially we will update the date at the top. Past versions are visible in the site's public source history.

Contact

Questions or requests: [email protected]. You can also reach us through the contact form, though please do not put sensitive details in it.

This notice covers what we do with personal data. What the service itself promises, and what it does not, is the terms of service.