Privacy Policy

1.1 Personal Information You Provide

When you register for services, request a free security assessment, or engage any of our offerings — including SOC-as-a-Service, Penetration Testing, Continuous Pen Testing, Security Audits, Compliance Advisory, or Consulting — we collect:

• ›Contact Information: Name, company name, email address, phone number, business address
• ›Account Credentials: Username, password, security questions
• ›Billing Information: Billing address, tax identification numbers, and payment details required for invoicing
• ›Contract Information: Electronic signature data via DocuSign, company authorization details
• ›Assessment & Scoping Data: Details about your security posture, penetration test scope (URLs, IP ranges, systems), audit requirements, compliance needs (DORA, NIS2, ISO 27001, PCI DSS, HIPAA), and consulting objectives
• ›Free Assessment Submissions: Information submitted through our online Free Security Assessment form, including company size, industry, and specific security concerns

1.2 Information Collected Automatically

When you access our website or use our services, we automatically collect certain information, including:

• ›Device Information: IP address, browser type, operating system, device identifiers
• ›Usage Data: Pages visited, time spent on pages, links clicked, referring URLs
• ›Cookies and Tracking: We use cookies and similar tracking technologies to track activity and hold certain information

1.3 Security Monitoring Data (SOC-as-a-Service Customers)

If you subscribe to our SOC-as-a-Service, we collect and process:

• ›Network Data: Network traffic logs, firewall logs, intrusion detection/prevention logs
• ›Endpoint Data: Security agent data from monitored endpoints, process information, file hashes, behavioral analytics
• ›Authentication Logs: Login attempts, access patterns, identity and access management logs
• ›Security Events: Alerts, incidents, threat intelligence indicators, vulnerability scan results
• ›User Activity: User behavior analytics for security monitoring purposes only

This data is collected solely for the purpose of providing security monitoring services and is handled with the highest level of confidentiality.

1.4 Penetration Testing & Continuous Pen Testing Data

When you engage our penetration testing or continuous security validation services, we collect and process:

• ›Scope & Target Information: IP addresses, domain names, URLs, network ranges, application details, and system inventories provided for testing
• ›Test Findings: Vulnerability details, proof-of-concept data, exploit paths, and risk ratings discovered during testing
• ›Remediation Tracking: Status of identified vulnerabilities, fix verification records, and re-test results
• ›Platform Data (Continuous Testing): Data processed by automated testing platforms (e.g., RidgeBot, NodeZero, Pentera, Cymulate) on your behalf

All penetration testing data is strictly confidential and used solely to deliver findings and reports to you. Raw exploit data is securely deleted after report delivery.

1.5 Compliance & Audit Engagement Data

When you engage our compliance advisory or security audit services (DORA, NIS2, ISO 27001, and others), we collect:

• ›Organizational Documentation: Policies, procedures, risk registers, and governance documents shared for review
• ›Gap Analysis Data: Results of compliance assessments, control evaluations, and regulatory gap findings
• ›Remediation Plans: Action plans, timelines, and accountability records for addressing compliance gaps
• ›Audit Evidence: Supporting documentation and evidence provided or gathered during audit activities

Compliance and audit data is treated as highly confidential. It is used solely to deliver advisory services and is never shared with third parties without your explicit consent.

1.6 Consulting Engagement Data

During cybersecurity consulting engagements (including vCISO services, security strategy, and policy development), we may collect:

• ›Business Context: Organizational structure, technology landscape, business processes, and strategic objectives relevant to security planning
• ›Security Posture Information: Current security controls, past incident history, and existing policy documentation
• ›Deliverables Data: Information used to develop security roadmaps, policies, training materials, and strategic recommendations

3.1 Service Providers

We share data with trusted third-party service providers who assist us in operating our services:

• ›Stripe: Payment processing and subscription billing management
• ›DocuSign: Electronic signature services for contract execution
• ›Security Tool Vendors: SIEM, EDR, and other security platforms used to deliver monitoring services
• ›Cloud Infrastructure: Hosting providers for data storage and processing

These service providers are contractually obligated to keep your information confidential and use it only for the purposes we specify.

3.2 Legal Requirements

We may disclose your information when required by law, such as:

• ›In response to valid legal processes (subpoenas, court orders, warrants)
• ›To comply with applicable laws and regulations
• ›To protect the rights, property, or safety of TESSA Security, our customers, or others
• ›To detect, prevent, or address fraud, security, or technical issues

3.3 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on our website before your information becomes subject to a different privacy policy.

3.4 With Your Consent

We may share your information for any other purpose with your explicit consent.

6.1 General Rights

• ›Access: Request a copy of the personal information we hold about you
• ›Correction: Request correction of inaccurate or incomplete data
• ›Deletion: Request deletion of your personal data (subject to legal obligations)
• ›Portability: Request your data in a structured, machine-readable format
• ›Objection: Object to processing of your data for certain purposes
• ›Restriction: Request restriction of processing under certain circumstances

6.2 GDPR Rights (European Economic Area Residents)

If you are located in the EEA, you have additional rights under the General Data Protection Regulation (GDPR):

• ›Right to withdraw consent at any time
• ›Right to lodge a complaint with a supervisory authority
• ›Right to receive information about automated decision-making and profiling

6.3 CCPA Rights (California Residents)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA):

• ›Right to know what personal information is collected, used, shared, or sold
• ›Right to delete personal information held by businesses
• ›Right to opt-out of the sale of personal information (Note: We do not sell personal information)
• ›Right to non-discrimination for exercising CCPA rights

6.4 Exercising Your Rights

To exercise any of these rights, please contact us at info.sec.ks@tessa.group. We will respond to your request within 30 days. You may be required to verify your identity before we process your request.