Privacy Policy

AKASEC B.V., Wilhelmina van Pruisenweg 104, 2595 AN The Hague, the Netherlands. For any privacy question or to exercise your rights, contact privacy@sakasec.ai.

• Account & contact data: name, work email, company name, job title, phone number.
• Scope data: the domains and assets you submit for discovery.
• Authentication data: hashed password and, if you enable it, an encrypted two-factor (TOTP) secret.
• Billing data: subscription status and identifiers. Card details are handled by Stripe, and we do not store card numbers.
• Report & usage data: the reports we prepare for you and basic logs needed to run and secure the service.
• Threat Hunting tenant data: read-only security telemetry (for example Microsoft Defender XDR signals) from the Microsoft 365 tenant you authorise, processed to produce your hunt report. We handle this as your processor (see section 5).
• Communications: emails you exchange with us.

The discovery work itself concerns externally visible technical information about your organisation; where that incidentally includes personal data, we process it to provide the service you requested.

• To provide the service (account, discovery, reports, support): performance of a contract.
• To take payment and manage subscriptions: performance of a contract and compliance with legal (accounting/tax) obligations.
• To secure and improve the service (authentication, logging, abuse prevention): our legitimate interests in running a secure service.
• To send service and, where permitted, relevant updates: legitimate interests or consent, as applicable.

We use a small number of vetted providers who process data on our behalf under data-processing agreements:

• Amazon Web Services (AWS): application hosting, database and report storage, in the EU (Frankfurt, eu-central-1).
• Stripe: payment processing and subscription billing.
• Postmark: transactional email delivery.
• Cloudflare: DNS, inbound email routing and content delivery.

We do not sell your personal data. We disclose data to authorities only where legally required.

The Threat Hunting service is different from the rest of SAKASEC. To run a hunt, you grant us read-only access to security telemetry in your own Microsoft 365 / Microsoft Defender XDR tenant, through Microsoft’s admin-consent flow. That telemetry can contain personal data about your users. For this processing you are the controller and AKASEC acts as a processor on your behalf. This section, together with our Terms, forms our processing terms under Article 28 GDPR; a separate signed data-processing agreement is available on request.

As your processor, we:

• process the tenant telemetry only on your documented instructions and only to perform the hunt and produce your report;
• do not modify your tenant, and do not use the telemetry for any other purpose, including training AI models;
• keep the telemetry confidential and restrict access to the personnel who need it for the hunt;
• process and store the telemetry on our EU infrastructure (AWS, Frankfurt) and apply the security measures described in section 10;
• engage sub-processors only under equivalent obligations (for Threat Hunting, Amazon Web Services for EU hosting and storage); the telemetry originates from your own Microsoft 365 tenant, which you control;
• assist you, taking into account the nature of the processing, with data-subject requests and with your security, breach-notification and data-protection-impact-assessment obligations;
• notify you without undue delay after becoming aware of a personal-data breach affecting your telemetry;
• on expiry or revocation of access, stop accessing your tenant and delete the telemetry and derived working data within a reasonable period, except findings retained in the report delivered to you and anything we must keep by law;
• make available the information needed to demonstrate compliance and allow for reasonable audits.

You remain responsible for having a lawful basis to grant this access and for ensuring the person who grants admin consent is authorised to do so on behalf of your organisation.

Our application data is hosted in the EU. Some processors may process limited data outside the EEA; where they do, transfers are covered by appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

We keep account and scope data for as long as you have an account and as needed to provide the service, then delete or anonymise it within a reasonable period, unless a longer retention is required by law (for example, invoices for tax purposes). Reports are retained so you can access them via the dashboard until deleted. For Threat Hunting, we retain tenant telemetry only as long as needed to run the hunt and prepare your report, then delete it (see section 5).

Under the GDPR you may:

• access the personal data we hold about you;
• have inaccurate data corrected, or data erased;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent where processing is based on consent.

To exercise any right, email privacy@sakasec.ai. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

We use only strictly necessary cookies, for example a secure session cookie to keep you signed in to the dashboard. We do not use advertising or third-party tracking cookies.

We apply technical and organisational measures appropriate to the risk, including encryption in transit, hashed passwords, encrypted two-factor secrets, access controls and non-guessable identifiers on customer-facing resources.

We may update this policy from time to time; the “last updated” date above reflects the latest version. For any question, contact privacy@sakasec.ai.