Privacy Policy
1. Scope and controller
Sanctum SecOps LLC (Pine City, New York, USA) is the controller for personal data processed across sanctumsecops.com and every hostname in the Sanctum web estate, including the soc, arena, validate, trust, ecc, qzt, chain, ca, api, rpc, docs and stage subdomains, our Cloudflare Access gated portals and our APIs. Privacy contact: privacy@sanctumsecops.com.
2. Data we collect
- Request metadata at the Cloudflare edge: IP address, user agent, TLS version and cipher, requested hostname and path, timestamps and request identifiers such as cf-ray.
- Identity and session data from Cloudflare Access or a federated identity provider: email, IdP subject, group and role claims, device posture signals.
- Certificate and enrollment data: CSR contents, subject DN, subject alternative names, public keys, serial numbers, validity and revocation events, hardware attestation statements.
- Support and business data: tickets, correspondence, contact and contracting details you submit.
- Operational telemetry: application logs, performance metrics and error traces.
3. Purposes and legal bases
- Delivering and supporting requested services — performance of a contract.
- Authentication, authorization, abuse prevention and infrastructure protection — legitimate interests and legal obligation.
- Certificate lifecycle management and audit evidence — contract and legal obligation.
- Compliance obligations including NIST SP 800-171 and CMMC controls — legal obligation.
- Service, security and enquiry communications — legitimate interests or consent.
4. Cookies and edge state
No advertising networks, cross-site trackers or behavioural profiling. Only strictly necessary state is set: the Cloudflare Access session token, Cloudflare security and bot-management cookies, and a non-identifying stage-gate preference used by our loaders.
5. Processors and subprocessors
- Cloudflare — edge delivery, WAF, Access, Workers, KV, D1.
- GitHub — source control and CI/CD.
- Neon and Supabase — managed Postgres, evidence ledger, control plane.
- Microsoft 365 and Entra ID — mail, collaboration, directory.
- Datadog and Sentry — monitoring and error tracking.
- Helpdesk and billing providers — ticketing and payments.
Each operates under a written data processing agreement limited to documented instructions.
6. Public records and immutable evidence
Data inside issued certificates may become publicly visible, including via certificate transparency logs and published revocation lists. Ledger entries, Merkle tree heads and timestamp proofs are cryptographically append-only and cannot be altered or deleted once anchored.
7. Retention
- Edge and WAF logs: 30 days by default.
- Authentication and Access decision logs: up to 12 months.
- CA audit records and ledger entries: as required by the applicable Certificate Policy and CPS.
- Support tickets: up to 24 months after closure.
- Contract, tax and procurement records: as required by law.
8. How we protect data
TLS 1.3 with hybrid post-quantum key establishment where the client supports it, post-quantum signature verification in attestation paths, private keys held in HSMs or hardware tokens, zero-trust least-privilege access, secrets in managed vaults, and encryption in transit and at rest.
9. International transfers
Services are operated from the United States on distributed edge infrastructure. Transfers out of the EEA, UK or Switzerland rely on Standard Contractual Clauses with supplementary technical measures.
10. Your rights
Subject to jurisdiction, you may request access, correction, deletion, restriction or portability, or object to processing. California residents may request disclosure, deletion and correction and opt out of sale or sharing — we do not sell or share personal data. Email privacy@sanctumsecops.com; we verify identity and respond within 30 days. Requests that would require breaking an immutable audit record are answered with the applicable legal exemption.
11. Government and regulated engagements
Federal Contract Information and Controlled Unclassified Information are handled only under executed agreements and the corresponding NIST SP 800-171 control set. Do not submit controlled information through public web forms; use the designated gated intake channel.
12. Children
Our services are business-to-business and are not directed to children. We do not knowingly collect personal data from anyone under 16.
13. Changes and contact
This policy is version controlled in our source repository; the effective date changes with every published revision and material changes are notified to account contacts beforehand. Questions: privacy@sanctumsecops.com. Legal notices: legal@sanctumsecops.com.