Privacy Policy

1. Who we are

PosturaNet Inc. ("PosturaNet", "we", "us") operates the PosturaNet cloud security remediation platform at posturanet.com and its subdomains. This policy explains what information we collect, why, and the choices you have.

2. Information we collect

Waitlist and account information: when you apply for early access or create an account, we collect your name, email address, role, and company name.

Cloud configuration metadata: once you connect an AWS account, we read resource configuration data (IAM policies, security group rules, S3 bucket settings, and similar control-plane metadata) via a cross-account IAM role you grant us. We do not access the contents of your application databases, object storage payloads, or end-user data stored in your AWS account.

Usage data: standard web analytics (pages viewed, browser type, referring URL) and product usage events (features used, findings viewed, remediations approved) to operate and improve the product.

Communications: emails you send us, and support or sales conversations.

3. How we use information

To operate the waitlist and product; to detect misconfigurations and generate remediations in accounts you connect; to send verification, product, and security-related emails; to provide support; to improve the product; and to meet legal and compliance obligations.

4. How we share information

We do not sell personal information. We share data with subprocessors who help us run the service (cloud hosting, email delivery, error monitoring), each bound by confidentiality and data-processing terms, and we disclose information when required by law or to protect the rights, property, or safety of PosturaNet, our customers, or others.

5. Security

Data is encrypted in transit with TLS 1.3 and at rest with AES-256. Cross-account access to your AWS environment uses short-lived, scoped credentials obtained via sts:AssumeRole — we never store long-lived AWS credentials. See our Trust Center for more detail on our current security practices.

6. Data retention

We retain account and configuration data for as long as your account is active, and audit log records for the period required to provide the compliance evidence the product is designed to generate. You can request deletion of your data by contacting us at the address below, subject to legal retention requirements.

7. Your choices

You can access, correct, or request deletion of your personal information, and unsubscribe from non-essential emails at any time via the link in those emails. Depending on where you live, you may have additional rights under applicable law (for example GDPR or CCPA); contact us to exercise them.

8. Changes to this policy

We will update the "last updated" date above when this policy changes, and will notify active customers of material changes.

9. Contact

Questions about this policy or your data: privacy@posturanet.com.