Privacy Policy

1. Our Approach

Sevorix is a security tool. We collect the minimum data necessary to operate the Services and keep your infrastructure secure, and we are specific below about what that is. We do not sell your personal information.

2. Sevorix Lite — Nothing Is Collected

• What we collect: Nothing. Lite runs entirely on your machine — no account, no telemetry, no data sent anywhere.
• How we use it: N/A — there is nothing to use.
• How to delete it: N/A — there is nothing on our servers to delete. Everything lives in your own logs, on your own machine, under your own control.

Because Lite is open source under AGPL-3.0, you can verify this in the source code rather than relying on our word for it.

3. Sevorix Pro

What we collect:

• Account info — name, email, billing details (your card number itself goes to Stripe, not to us)
• The policies and rules you configure
• A record of every Block, Modify, or Allow event — which agent, what action, which policy matched, the verdict, and when
• Basic usage data — which features get used, and error logs

How we use it:

• The event records are your audit trail — that is what populates your Observatory
• Account info runs billing and support
• Usage data helps us find bugs and improve the product
• Nothing here is sold, and nothing is used to improve detection unless you separately opt in

How to delete it:

• Event and policy data — delete it yourself, anytime, from the Sevorix Observatory
• Full account deletion — email privacy@sevorix.com
• Billing records are kept a bit longer where the law requires it for tax and accounting, even after you delete everything else

4. Sevorix Enterprise

What we collect:

Depends entirely on how you deploy.

• Self-hosted or air-gapped: nothing leaves your environment, same as Lite
• Cloud-connected: the same categories as Pro, with retention and specifics set by your contract

How we use it:

The same as Pro, for anything not self-hosted.

How to delete it:

The same Observatory self-service as Pro, plus whatever process your order form spells out — enterprise contracts usually add their own deletion and retention terms.

5. The One Universal Rule

Before anything is evaluated, sensitive values — PII, credentials, anything the tokenization layer flags — are swapped for sterile tokens first. The raw sensitive data is never retained, on any tier.

6. Legal Basis for Processing (EEA / UK Users)

Where the GDPR or UK GDPR applies, we process personal data under: performance of a contract (to provide the Services), our legitimate interests (to secure and improve the Services), and your consent (where you have opted into a specific use).

7. Your Rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, and to object to or restrict certain processing. California residents have rights under the CCPA / CPRA, including the right to know, the right to delete, and the right to correct.

Categories of personal information we collect: identifiers (name, email); commercial information (subscription and billing records); internet or network activity (usage and error logs); and the configuration and event data you generate in the Services. We collect it to provide, secure, support, and bill for the Services. We do not sell or "share" personal information as those terms are defined under the CCPA / CPRA.

To exercise any of these rights, contact privacy@sevorix.com. You can also delete historical event and policy data at any time from the Sevorix Observatory. If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection supervisory authority.

8. Data Retention

Sevorix Pro event metadata is retained for seven (7) days on a rolling basis. Enterprise retention is configurable and governed by your order form. Account and billing records are retained as required for legal, tax, and accounting purposes.

9. Service Providers

We use a small number of providers to operate the Services, including Stripe for payment processing and Microsoft Azure for hosting and infrastructure. These providers are contractually bound to use your information only to provide services to us.

10. Data Security

We use industry-standard technical and organizational measures, including encryption in transit (TLS) and at rest, to protect the information we hold. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Data Breach Notification

If we become aware of a personal-data breach that is likely to affect your rights, we will notify you and any applicable regulator without undue delay and in accordance with applicable law.

12. Cookies and Tracking

Our website uses essential cookies required for the site to function, and may use analytics cookies to understand aggregate usage. You can control cookies through your browser settings. We do not use cookies to sell your personal information.

13. Children's Privacy

The Services are not directed to individuals under 18, and we do not knowingly collect personal information from children.

14. International Data Transfers

If you access the Services from outside the United States, your information may be transferred to and processed in the United States, where our servers and service providers are located.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted here with an updated "Last Updated" date.

16. Contact

Privacy questions or data requests: privacy@sevorix.com

General legal inquiries: legal@sevorix.com