Trust
Privacy notice
How we collect and use personal data about the people who visit this website and use SurePosture.
Last updated 25 September 2026
Who we are
SurePosture is provided by [Company legal name], a company registered in England and Wales (company number [Companies House number]), registered office [Registered office address]. We are the controller for the personal data described in this notice, and are registered with the Information Commissioner's Office under number [ICO registration number].
This notice covers visitors to this website and the people who sign in to SurePosture. Data read from the Microsoft 365 tenants you assess is processed on your behalf, as your processor, and is described on the data protection page.
What we collect
| Data | When |
|---|---|
| Name, work email address, workspace name, role | When you sign up, are invited, or update your account |
| Password (stored only as a salted scrypt hash) | When you set or change it |
| IP address, browser user agent, sign-in times | When you sign in, and against actions recorded in the audit log |
| What you do in the service: tenants added, assessments run, reports generated, notes, approvals | As you use SurePosture |
| Billing contact and subscription status; card details are handled by Stripe and never reach us | When you subscribe |
| Your email notification preference | When you change it in Settings |
How and why we use it
| Purpose | Lawful basis |
|---|---|
| Providing the service: your account, workspace, reports and notifications | Performance of our contract with you or your organisation |
| Keeping the service and your data secure: sign-in, sessions, the audit log, preventing misuse | Legitimate interests in operating a secure service |
| Billing and keeping financial records | Contract, and our legal obligations |
| Service messages such as invitations and security notices | Contract, and legitimate interests |
We do not sell personal data, use it for advertising, or make automated decisions about you that have legal effects.
Cookies, local storage and analytics
We use one cookie, which keeps you signed in. It is strictly necessary, so it does not need consent. Your light or dark theme choice is kept in your browser's local storage. We do not use advertising or third-party tracking cookies.
The free email security check looks up the domain you enter in public DNS. The domain is held in memory for ten minutes so a repeat check is quick, and is not stored or linked to you.
We do not use analytics on this website.
Who we share it with
- Render, which hosts the service and its database in the EU (Frankfurt).
- [email delivery provider], which delivers our emails.
- Stripe, which processes subscription payments.
- Other members of your SurePosture workspace, who can see your name, role and the actions you take in it.
- Authorities, where the law requires us to.
Where a provider processes data outside the UK, we rely on UK adequacy regulations or the International Data Transfer Agreement or Addendum to protect it.
How long we keep it
- Account data: while your account is active; we delete it on request, or when your workspace is closed.
- Audit log entries: while the workspace exists, because they are the record of who did what.
- Billing records: six years, as UK tax law requires.
- Expired sessions are no longer usable after they expire.
Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased, or its use restricted, in certain circumstances;
- object to processing based on our legitimate interests;
- receive your data in a portable format.
To exercise any of these, email [privacy contact email]. We will respond within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.
Changes to this notice
We will update this page when how we use personal data changes, and tell account holders by email about significant changes. The date at the top shows when it was last updated.