Privacy Policy

1. Introduction

Security Brigade Infosec Pvt. Ltd. ("Security Brigade", "we", "us", or "our"), a company incorporated under the laws of India with its registered office in Mumbai, Maharashtra, operates the Coconut Security Dashboard (the "Platform") accessible at dash.securitybrigade.com.

This Privacy Policy describes how we collect, use, store, and protect your personal information when you access or use the Platform. This policy is drafted in compliance with the Information Technology Act, 2000 and its allied rules, the Digital Personal Data Protection Act, 2023 ("DPDP Act"), and the General Data Protection Regulation (EU) 2016/679 ("GDPR") to the extent applicable to our international clients.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, position/designation, mobile number, and IP address provided during account setup or profile updates.
• Authentication Data: Passwords (stored in hashed form), one-time passwords (OTPs), and static IP addresses used for access control.
• Communications: Content of emails or support requests you send to us.

2.2 Information Generated Through Platform Use

• Audit Data: Vulnerability scan results, penetration testing findings, compliance reports, and remediation status. This data belongs to your organisation and is processed by us on your behalf.
• Usage Data: Pages visited, features used, login timestamps, browser type, and device information, collected via essential cookies and analytics tools (Mixpanel, Sentry).
• Log Data: Server logs including IP addresses, request timestamps, and referrer URLs.

3. Purpose of Processing

We process your personal data for the following purposes:

• Providing access to the Platform and its features (vulnerability tracking, report downloads, compliance dashboards).
• Authenticating your identity and enforcing access controls.
• Sending notifications about new vulnerabilities, report availability, and status changes.
• Monitoring platform performance and diagnosing errors (via Sentry error tracking).
• Improving user experience and platform reliability (via Mixpanel analytics).
• Complying with legal obligations and responding to lawful requests.

4. Legal Basis for Processing

Purpose	Legal Basis
Platform access and service delivery	Performance of contract
Authentication and security	Legitimate interest; contractual obligation
Error monitoring (Sentry)	Legitimate interest
Analytics (Mixpanel)	Consent (via cookie consent banner)
Legal compliance	Legal obligation

5. Data Sharing

We do not sell your personal data. We may share data with:

• Service Providers: Cloud hosting (for platform infrastructure), Sentry/GlitchTip (error tracking), Mixpanel (analytics) — each bound by data processing agreements.
• Your Organisation: Audit data and reports are shared with authorised users within your organisation as configured by your administrator.
• Legal Authorities: Where required by applicable Indian law, court order, or regulatory directive.

6. Data Retention

We retain your personal data for the duration of our contractual relationship with your organisation. Upon termination, personal data is deleted within 90 days unless retention is required by law. Audit data (vulnerability reports, compliance records) is retained as agreed in the Master Services Agreement with your organisation.

7. Data Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS 1.2+), access controls, IP whitelisting, session management, and regular security audits. See our Security page for details.

8. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data (subject to legal obligations).
• Withdrawal of Consent: Withdraw consent for analytics cookies at any time via the cookie consent settings.
• Grievance Redressal: Under the DPDP Act, you may raise grievances with our Grievance Officer (details below).

9. International Transfers

Your data is primarily stored and processed in India. Where data is transferred outside India (e.g., to service providers in other jurisdictions), we ensure adequate safeguards are in place, including Standard Contractual Clauses (SCCs) for transfers subject to GDPR.

10. Grievance Officer

In accordance with the Information Technology Act, 2000 and the DPDP Act, 2023, the Grievance Officer for this Platform is:

Security Brigade Infosec Pvt. Ltd.
Email: [email protected]
Address: Mumbai, Maharashtra, India
Response time: Within 30 days of receipt of the grievance.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the Platform or email. Continued use of the Platform after such changes constitutes acceptance of the revised policy.

12. Contact Us

For questions about this Privacy Policy, contact us at [email protected].