How we protect
your information.

01Certification status

We are currently in a SOC 2 readiness program ahead of our formal audit. The audit itself has not yet taken place.

Our service is designed in alignment with the SOC 2 Trust Services Criteria and AWS Foundational Security Best Practices. Those references describe how our controls are designed. They are not the result of an independent review.

We will not describe our program as audited or certified until it has been, and we will not give an audit date until we have one. When the formal SOC 2 audit is complete, we will update this statement.

02Our approach

ObscureIQ handles information that can be sensitive by its nature. Protecting that information is central to our work.

We maintain administrative, technical, and organizational safeguards designed to reduce the risk of unauthorized access, disclosure, alteration, loss, or misuse.

We also limit the information we collect and retain, because information that is never collected, or no longer retained, cannot be exposed through our systems. That is the control that does the most work, and it is the one most security statements leave out.

No security program can eliminate every risk. This statement explains our current approach. It does not promise that a security incident can never occur.

03The principles behind it

Six, and they are the ones a reviewer should hold us to.

• Data minimization. We seek to collect and retain only the information reasonably needed to provide our services, secure our operations, meet legal obligations, and resolve disputes.
• Purpose limitation. We use personal information for defined business and service purposes.
• Restricted access. Access to sensitive information is limited according to role and business need.
• Defense in depth. We use multiple safeguards rather than relying on a single security control.
• Retention discipline. We delete or de-identify information when it is no longer reasonably required, subject to defined exceptions.
• Continuous improvement. We review and improve our controls as our services, systems, and risks change.

04The website

Our public website and services are designed to limit unnecessary collection and tracking. We do not use personal information to build advertising profiles, and we do not sell it for cross-context behavioral advertising.

One system processes technical information about a visit to this website, and the Privacy Notice describes it. Our host records standard web server logs, including IP addresses, for the purpose of serving the site and defending it against attack, and discards them after 30 days. The logs are not joined to anything else, and are not used to build a record of who you are. The site runs no analytics.

Our use of personal information is described more fully in our Privacy Notice. Where this statement and that notice address the same subject, they should be read together.

05Data storage and system access

Access to client information is limited to authorized personnel and service providers who need it for an approved purpose.

We use access restrictions, system separation, logging, and other safeguards appropriate to the sensitivity of the information and the function of the system. Access rights are reviewed, and may be changed or removed when responsibilities change.

We do not describe any system as completely isolated or immune from unauthorized access. Where systems must communicate with other systems or service providers, we seek to restrict those connections to approved purposes and protect them through appropriate access and network controls.

06Authentication

Multi-factor authentication is required for privileged or administrative access wherever the underlying system supports it.

We use authentication controls appropriate to the system and the level of access involved. Additional controls may be applied to sensitive systems and workflows.

Clients are responsible for protecting their own credentials, and for promptly telling us if they suspect unauthorized access to an account or a communication channel. If you think a channel between us has been compromised, say so through a different one.

07Encryption and transmission

We use encryption in transit and at rest where appropriate to the system, service, and information involved. We do not claim it is universal.

This website uses HTTPS. Supported systems use current transport-encryption configurations, such as TLS, to protect information while it travels across networks. Sensitive stored information may also be protected through platform encryption, database encryption, file encryption, access controls, or a combination of these.

08Service providers

Providers receive only the access reasonably needed to perform their contracted function, and are not authorized to use client information for their own unrelated purposes.

We use selected service providers to support functions such as infrastructure, communications and business operations. Before providing access to sensitive information we consider the provider's role, the information involved, and the safeguards appropriate to that relationship.

This sits alongside the firm's published conduct standard, which is the broader commitment:

09Payment information

ObscureIQ does not intentionally store complete payment-card numbers or card security codes in its operating systems.

Where payment transactions occur they are processed by third-party payment providers, who are responsible for the PCI DSS obligations applicable to their own payment-processing environments.

We do not claim that ObscureIQ's own operations are PCI certified merely because a payment provider maintains PCI DSS compliance. Those are different things, and the distinction is frequently blurred.

10Retention and deletion

We retain personal information for defined service, security, legal, contractual and operational purposes, and delete or de-identify it when it is no longer reasonably required.

What deletion actually means

Deletion from active systems does not always result in immediate removal from every backup. Backup copies are protected, and expire or are overwritten according to the applicable backup lifecycle. We would rather say that than claim an instantaneous erasure that no backup system performs.

Some information may be retained where reasonably necessary for legal compliance, dispute preservation, fraud prevention, accounting, security, or the establishment and defense of legal claims.

11Confidentiality and disclosure

We do not disclose client information to researchers, advocates, regulators, law-enforcement agencies or any other third party merely because they have asked for it.

We may disclose information when:

• the client directs or authorizes us to do so;
• disclosure is needed to provide a requested service;
• an authorized service provider requires the information for its contracted function;
• we reasonably believe disclosure is required by applicable law or valid legal process; or
• disclosure is reasonably necessary to protect the rights, safety, security or integrity of ObscureIQ, our clients, or others.

If we are compelled by valid legal process to disclose a client's information, we will tell the client before we comply unless we are legally forbidden from doing so, and we will narrow the response to what the process actually demands.

12Monitoring and incident response

We maintain procedures for identifying, evaluating and responding to suspected security events.

A response may include containing the event, investigating its scope, preserving relevant evidence, correcting identified weaknesses, and notifying authorities where required. If personal information we hold is exposed, we tell the people affected directly and promptly, whether or not a law requires it.

The nature of security testing and review varies by system and risk. We do not characterize a review as an independent audit, a penetration test, a certification or a formal assessment unless that work was actually performed within a defined scope.

13Personnel

Personnel with access to sensitive information are expected to follow applicable confidentiality, access-control and security requirements.

Security responsibilities are incorporated into relevant operating procedures and training.

14Changes to this statement

Our systems, providers and security practices change, and so will this statement.

We may revise it to reflect material changes, new services, or the development of our security program. The review date at the top identifies the most recent published revision, and an internal owner reviews it at least annually and after any material change.

15Reporting a security issue

If you find a security issue, please tell us.

Send reports to security@obscureiq.com, or use any of the contacts below. We will acknowledge a report, investigate it, and tell you what we found. We do not threaten people who report vulnerabilities in good faith.