Privacy Policy

AuditHat LLC, doing business as AuditHat and audithat.com ("AuditHat", "we", "us"), provides Flow, Pulse, the Pulse agent, and the websites at audithat.com and its subdomains (together, the "Services"). This Privacy Policy explains what information we collect, how we use and share it, how long we keep it, and the choices you have. It is part of our Terms of Service; capitalized terms have the meaning given there.

The Services are business tools. When a Customer connects its systems, we process the resulting Customer Data on that Customer's behalf and under its instructions. The Customer, not AuditHat, decides what systems to connect and is responsible for giving any notice to, and getting any consent from, its own employees and other people whose information appears in that data.

Account and contact information: name, work email address, company name, industry, role, password (stored only as a salted hash), and the version, date, time, and network address of each acceptance of our Terms and this policy.

Billing information: plan, invoices, and payment history. Card numbers are handled by our payment processor; we store only a token and the last four digits.

Customer Data collected by the Services from Monitored Systems that the Customer connects or installs the agent on, which can include:

• Active Directory objects (users, groups, computers, organizational units, password and account settings, group membership, privileged group members), Group Policy objects and their settings, and Windows security event logs (logons, failures, lockouts, password and account changes, group membership changes, including the account that made each change);
• Microsoft 365 / Entra ID tenant data read through Microsoft Graph with the permissions you consent to: users, licenses, authentication and MFA status, sign-in and audit logs, devices and compliance state, enterprise applications and their consented permissions, Conditional Access and other security policies, SharePoint and OneDrive sharing settings, Secure Score, and directory roles and groups;
• Firewall and network device configuration exports, SNMP data, and hardware and software inventories (hostnames, IP and MAC addresses, serial numbers, operating systems, installed software, BitLocker status);
• Documents, policies, evidence, and other files you upload to Flow, and the reports and findings the Services generate from all of the above.

Credentials you give the Services (for example firewall SSH or SNMP credentials, or Active Directory credentials for the agent) are encrypted at rest with keys held by AuditHat and are used only to connect to the systems you configure.

Usage and technical data: log data (IP address, browser and device information, pages viewed, actions taken, timestamps), agent heartbeat and version information, diagnostic and error data, and cookies or similar technologies needed to keep you signed in and to remember preferences. We do not use third-party advertising cookies.

Information from others: if a colleague invites you or requests access on your behalf, we receive your name and email from them.

• to provide, operate, secure, and support the Services, including detecting changes in your environment, generating reports and alerts, and responding to support requests;
• to create and manage your account, verify your email, authenticate you, and enforce our Terms;
• to bill you and collect amounts owed;
• to communicate with you about the Services, including security, billing, scheduled reports, and changes to our Terms or this policy;
• to monitor, troubleshoot, and improve the Services, and to develop new features, including through aggregated or de-identified data that does not identify you or any person;
• to comply with law, respond to lawful requests, and protect the rights, property, and safety of AuditHat, our customers, and others.

We do not sell personal information, and we do not use Customer Data to advertise to anyone.

When you connect Microsoft 365, our use of information received through Microsoft APIs is limited to providing and improving the Services for you and complies with Microsoft's API terms. We store copies (snapshots) of the tenant data described above so that we can show history and detect changes over time, and we delete those copies under Section 7. You can revoke our access at any time from the Entra ID enterprise applications page in your tenant or by disconnecting the integration in Pulse.

Other connected platforms (firewalls, network devices, Windows domain controllers) are governed by their own vendors' terms; data we collect from them is Customer Data under the Terms.

• Service providers that process data for us under contract, such as cloud hosting and storage, email delivery, payment processing, and error monitoring. They may use the data only to provide their services to us.
• Within your organization: your administrators and the Users they authorize can see Customer Data, reports, and account information for your tenant, and can see who made or approved tracked changes.
• People you direct us to share with, for example email recipients you configure for scheduled reports.
• Legal and safety: when required by law, subpoena, or court order, or when we believe disclosure is necessary to protect rights, property, or safety, to enforce our Terms, or to investigate fraud or security issues.
• Business transfers: if AuditHat is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction under this policy.
• Aggregated or de-identified information that cannot reasonably be used to identify you or any person.

We use commercially reasonable administrative, technical, and physical safeguards designed to protect information, including encryption in transit (TLS), encryption of stored credentials, tenant isolation in our database, role-based access, and logging. No system is perfectly secure, and we cannot guarantee that information will never be accessed, disclosed, altered, or destroyed. You are responsible for the security of your own systems, of the credentials you give the Services, and of the devices your Users sign in from, and for keeping independent backups of anything important. If we learn of a breach affecting your information we will notify you as required by law.

We keep account information for as long as your account exists. Customer Data is kept while the connected system or integration remains active, subject to product retention limits (for example, tracked change events and daily snapshots are kept for a rolling window, currently up to 400 days for change events, and older snapshots are pruned automatically).

It is your data. You can delete individual items, disconnect integrations, remove agents, request removal of your Customer Data, or cancel the Services at any time using the tools in the product or by contacting us. After a removal request or cancellation we delete or de-identify Customer Data within a commercially reasonable time, normally within 30 days, except for copies in routine backups (which expire on their own schedule, normally within a further 30 days) and information we must keep to comply with law, resolve disputes, enforce our Terms, or complete billing, including records of your acceptance of our Terms.

Usage logs are kept for a limited period for security and troubleshooting and then deleted or de-identified.

You can view and update your account information in the product. You can export your reports and data from the product, and you can ask us for a copy of the information we hold about you. You can ask us to correct or delete personal information, object to or restrict certain processing, and, where the law provides, lodge a complaint with a supervisory authority. To exercise these rights, contact us at the address in Section 12. We may need to verify your identity, and requests that relate to Customer Data of an organization will be referred to that organization's administrator, because they control that data.

Transactional emails (verification, security, billing, scheduled reports you configure) are part of the Services and cannot be opted out of while you have an account.

AuditHat is based in the United States and processes and stores information in the United States. If you use the Services from outside the United States, you understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those in your location.

The Services are not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

We may update this policy from time to time. When we do, we will publish the new version with a new effective date, and you will be asked to accept it the next time you sign in. Continued use of the Services after a new version is published is acceptance of that version; the latest published version always applies.

Privacy questions and requests: flow@audithat.com. AuditHat LLC, doing business as AuditHat and audithat.com.