Privacy is part of the security model .

Hayrok LLC ("Hayrok," "we," "us," or "our") respects the privacy and security of the information entrusted to us.

This Privacy Policy explains how Hayrok collects, uses, discloses, retains, and protects personal information when individuals:

• Visit Hayrok websites
• Request a demo
• Contact Hayrok
• Create or use a Hayrok account
• Participate in a trial, pilot, or design-partner program
• Use the Hayrok platform
• Interact with Nectar or other AI-assisted capabilities
• Attend Hayrok events or webinars
• Participate in sales, support, partner, or customer relationships
• Otherwise interact with Hayrok

Hayrok provides a Governed Adversarial Exposure Validation platform. Because customers may use Hayrok to process security information about their own environments, this policy distinguishes between information Hayrok controls for its own business purposes and information processed on behalf of customers.

This Privacy Policy applies to personal information Hayrok processes in connection with:

Hayrok websites

Including public marketing, documentation, resource, product-tour, Trust Center, and related web properties.

Hayrok platform

Including account administration, validation workflows, findings, evidence, reports, integrations, attack-path intelligence, and related services.

Nectar

Hayrok's evidence-grounded intelligence and reasoning experience.

Sales and marketing

Including demo requests, events, webinars, communications, campaigns, and business-development activities.

Customer and partner relationships

Including procurement, implementation, support, security reviews, and partner programs.

This policy does not govern third-party websites, applications, products, or services that Hayrok does not control.

Hayrok may process personal information in different roles depending on the context.

When Hayrok acts as a controller

Hayrok generally determines the purposes and means of processing information associated with: website visitors, prospects, marketing contacts, demo requests, customer administrators, billing and commercial contacts, support communications, event participants, partner contacts, Hayrok account administration, and security and fraud prevention.

When Hayrok acts as a processor

Customers may submit information to Hayrok when using the platform — including asset information, user or identity metadata, security findings, application and infrastructure information, telemetry, evidence, logs, reports, and integration data. Where Hayrok processes this information solely to provide services on behalf of a customer, the customer generally determines the purposes and Hayrok acts as a processor or service provider.

If you are an individual whose information has been provided to Hayrok by a customer, requests relating to that information may need to be directed to the customer that controls it.

The information we collect depends on how you interact with Hayrok.

Information you provide directly

• Name, business email, company, job title, phone number, country/region
• Account credentials or authentication identifiers
• Organization information, support requests, demo requests, sales communications
• Survey responses, event registrations, partner applications, security-review requests
• Feedback and communications with Hayrok

We may also collect information you voluntarily provide when interacting with Nectar or other platform features.

When you create or access a Hayrok account, we may process user identifier, email, organization, tenant, assigned role, permission information, authentication method, SSO information, session information, login activity, MFA status, identity-provider information, and account status.

Hayrok uses identity information to authenticate users, enforce authorization, protect tenant boundaries, and maintain security audit records.

Customers may configure Hayrok to process security information from their environments.

Asset information

Applications, APIs, domains, cloud resources, Kubernetes workloads, containers, repositories, services, infrastructure metadata.

Security findings

Vulnerabilities, misconfigurations, security weaknesses, validation outcomes, remediation information.

Identity context

User identifiers, service-account identifiers, roles, permissions, trust relationships.

Security telemetry

SIEM events, WAF events, API gateway records, cloud audit events, Kubernetes telemetry, application logs, detection results.

Validation evidence

Requests and responses, runtime observations, control responses, detection events, reachability results, screenshots, execution metadata, approval records.

Attack-path information

Relationships between assets, identities, permissions, findings, controls, runtime resources, and critical assets.

Hayrok does not intend for customers to submit unnecessary personal information to the platform and encourages configuring integrations and validation scopes in accordance with data-minimization principles.

When Hayrok performs an authorized security validation, we may process information associated with the validation workflow, including: objective, target scope, authorized assets, environment, scenario, execution plan, agent and tool activity, policy and approval decisions, execution timestamps, control and detection responses, evidence artifacts, validation result, finding information, and revalidation result.

This information may be necessary to provide evidence-backed security outcomes and maintain an auditable validation record.

How Nectar uses information

Nectar is Hayrok's evidence-grounded intelligence and reasoning layer. It may process authorized Hayrok information to help users explain findings, interpret evidence, analyze attack paths, understand control behavior, analyze detection outcomes, prioritize remediation, summarize reports, prepare executive explanations, and guide revalidation.

The information available to Nectar remains subject to the same tenant and authorization boundaries applied elsewhere in the Hayrok platform.

AI context may include

Findings, evidence artifacts, asset context, validation history, runtime information, control responses, detection events, attack-path information, remediation information, and reports — subject to the user's permissions and request.

AI providers

Hayrok may use third-party AI infrastructure or model providers to support certain AI functionality. Where third parties process customer information on Hayrok's behalf, they are subject to contractual, privacy, and security requirements appropriate to their role. Current applicable providers are disclosed through the Hayrok subprocessor documentation.

AI training

Hayrok does not use Customer Data to train general-purpose AI models. Any use of Hayrok-operated or third-party model workflows on customer information is described in the applicable contractual documentation and reflected in the Trust Center.

When individuals use Hayrok websites or services, we may automatically receive IP address, browser type, device type, operating system, referral source, pages visited, features used, time and date of activity, session information, approximate geographic region, and diagnostic/performance/error information.

We use this information for security, fraud prevention, product reliability, website operation, analytics, troubleshooting, and user-experience improvement.

Hayrok websites may use cookies and similar technologies for the following purposes.

Strictly necessary

Required for security, authentication, session management, and core site operation.

Preferences

Used to remember user choices.

Analytics

Used to understand website usage and improve the experience.

Marketing

Where enabled and legally permitted, technologies may be used to understand campaign effectiveness or provide relevant communications.

Where required by law, Hayrok obtains consent before placing non-essential cookies. Users can manage applicable choices through Cookie Settings. A separate Cookie Policy may be published if tracking technologies materially expand.

We may receive information from identity providers, customers, business partners, event providers, integration providers, cloud platforms, security systems, public business sources, professional networks, marketing platforms, and service providers.

Information received from integrations is processed according to the customer's configuration and applicable contractual terms.

Provide the service

Create and manage accounts, authenticate users, enforce permissions, operate the platform, provide validation functionality, generate findings and evidence, provide Nectar, generate reports.

Secure Hayrok and customers

Prevent fraud, detect abuse, monitor authentication, investigate suspicious activity, protect tenant isolation, maintain audit logs, respond to security events.

Support customers

Respond to requests, troubleshoot issues, provide implementation support, conduct security reviews, manage customer relationships.

Improve our products

Analyze product usage, diagnose failures, improve reliability, develop new features, evaluate system performance. Where customer content is used for product improvement, use remains consistent with contractual commitments, privacy requirements, and applicable customer controls.

Communicate with you

Respond to inquiries, send service and security notices, send requested resources, communicate about events, provide product information.

Business operations & legal

Billing, contract administration, partner management, procurement, finance, business planning, corporate transactions, responding to valid legal requests, protecting legal rights, maintaining required records, enforcing agreements, complying with applicable law.

Where laws such as the GDPR or UK GDPR apply, Hayrok may process personal information based on one or more applicable legal bases.

Contract

Processing necessary to provide services requested under an agreement.

Legitimate interests

Processing necessary for legitimate business interests such as securing the platform, preventing fraud, operating and improving services, supporting customers, and managing business relationships — where those interests are not overridden by applicable individual rights.

Consent

Where consent is required, such as certain marketing communications or non-essential tracking technologies.

Legal obligation

Processing required to comply with law.

Service providers and subprocessors

Providers that support functions such as cloud infrastructure, authentication, AI services, monitoring, communications, support, analytics, billing, and business operations. These providers process information according to contractual restrictions and applicable security requirements. View subprocessors.

Customer-authorized integrations

Cloud providers, SIEM, EDR, WAF/CDN, API gateways, identity providers, CI/CD systems, source control, ticketing platforms, and collaboration systems.

Professional advisers

Lawyers, auditors, accountants, insurers, and security advisers, where reasonably necessary.

Legal and safety

Comply with law, respond to valid legal process, protect users, investigate fraud or abuse, protect Hayrok's rights, protect the security of systems.

Corporate transactions

Merger, acquisition, financing, reorganization, asset sale, or similar corporate transaction, subject to applicable legal requirements.

Hayrok does not sell Customer Data submitted to the Hayrok platform for use in providing security validation services.

If Hayrok engages in activities that constitute "sale" or "sharing" of personal information under a particular privacy law through advertising or website technologies, applicable disclosures and opt-out mechanisms will be provided. This section is reviewed against Hayrok's actual marketing-technology configuration before publication.

Hayrok and its service providers may process information in countries other than the country where the information was originally collected.

Where required, Hayrok uses recognized safeguards for international transfers, which may include contractual protections, standard contractual clauses, transfer assessments, appropriate supplementary security measures, and other legally recognized transfer mechanisms.

The precise transfer mechanisms reflect Hayrok's current corporate and subprocessor arrangements.

Hayrok retains information for only as long as reasonably necessary for the purposes for which it was collected, including delivering contracted services, maintaining security, supporting investigations, meeting legal requirements, resolving disputes, and enforcing agreements.

Retention periods may vary by data type — account data, validation evidence, findings, reports, audit logs, authentication events, support communications, marketing records, and integration data.

Customer contractual terms or plan configuration may provide specific retention controls for certain platform information.

Customers may request deletion of eligible data subject to contractual commitments, legal requirements, security requirements, backup lifecycle, fraud-prevention obligations, and required audit history.

Deletion workflows account for data stored in primary databases, evidence stores, object storage, search indexes, caches, analytics systems, backups, and derived systems. Deletion from backup systems may occur through the normal backup-retention lifecycle rather than immediately.

Protecting information is fundamental to Hayrok

Hayrok uses technical and organizational measures designed to protect information against unauthorized access, unauthorized disclosure, alteration, loss, destruction, and misuse.

Controls include encryption in transit, encryption at rest, tenant isolation, strong authentication, enterprise SSO, role-based and contextual access control, policy enforcement, service-to-service authentication, network segmentation, private execution options, secrets management, audit logging, security monitoring, vulnerability management, and secure software-development practices.

No security system can eliminate all risk. For additional detail, visit the Hayrok Security & Trust Center.

Customers are responsible for configuring and using Hayrok consistently with applicable law and their own privacy obligations. This includes:

• Ensuring appropriate authority to process information
• Defining authorized validation scope
• Managing users and permissions
• Configuring integrations appropriately
• Avoiding unnecessary sensitive information
• Establishing appropriate retention
• Providing required notices to their personnel
• Responding to relevant data-subject requests
• Using Hayrok only against systems they are authorized to assess

Depending on your jurisdiction, you may have rights relating to personal information — access, correction, deletion, restriction, objection, portability, withdrawing consent, opting out of certain marketing, appealing certain privacy decisions, or lodging a complaint with a regulator. These rights may be subject to legal exceptions.

Hayrok does not discriminate against individuals for exercising legally protected privacy rights.

Where applicable, individuals may have rights under European data-protection law — access, rectification, erasure, restriction, portability, objection, and withdrawal of consent — and the right to lodge a complaint with their local data-protection authority.

Where Hayrok processes Customer Data as a processor, the applicable customer may be responsible for responding to the request.

Residents of certain U.S. states may have additional privacy rights under applicable state law — to know what personal information is collected, access, correct, delete, obtain a copy, opt out of certain sales/sharing/targeted advertising, limit certain uses of sensitive personal information, and appeal a denied request.

Hayrok honors applicable rights based on the law that applies to the requester. The public privacy-request workflow does not promise rights that do not apply in a particular jurisdiction.

Where applicable, California residents may have rights under California privacy law. Categories of information Hayrok may process include identifiers, commercial information, internet or electronic activity, professional information, account information, security information, and inferences associated with product or business interactions.

Purposes for processing are described throughout this Privacy Policy. Hayrok maintains a California-specific disclosure reflecting actual data practices, including any sale or sharing determinations associated with advertising technologies.

Where Canadian privacy law applies, Hayrok processes personal information in accordance with applicable requirements concerning accountability, appropriate purpose, consent, limited collection, limited use, safeguards, transparency, and individual access. Specific Canadian notices may be provided where required.

Individuals may unsubscribe from marketing communications using the unsubscribe mechanism provided in the communication.

Even after opting out of marketing, users may still receive non-marketing communications such as security notices, account notices, service communications, billing messages, and contractual communications.

Hayrok may use AI and automated systems to assist with security analysis, recommendations, prioritization, and product functionality.

Hayrok's approach keeps consequential security decisions subject to appropriate human accountability, policy controls, authorization, evidence, and governance. Nectar does not independently make high-impact decisions such as accepting customer risk, modifying production resources, or approving sensitive validation activity.

Read the Hayrok Responsible AI Principles.

Hayrok's services are designed for businesses and security professionals. They are not intended for children. Hayrok does not knowingly seek to collect personal information from children through its enterprise services.

If Hayrok learns that information was collected from a child in circumstances where processing is not appropriate, it will take reasonable steps to delete the information.

Hayrok may link to or integrate with third-party services. Those organizations control their own privacy practices. Hayrok encourages users to review the privacy notices of third-party services before providing them with information.

Hayrok may update this Privacy Policy as products evolve, privacy practices change, laws change, new services are introduced, and new subprocessors are adopted.

The current version always displays the Last Updated date at the top of this document. Where required by law or contract, Hayrok will provide additional notice of material changes.

Privacy questions

For questions about this Privacy Policy or Hayrok's privacy practices, contact:

Hayrok LLC
Privacy email: privacy@hayrok.com

Is your information managed by a Hayrok customer?

If your personal information appears in Hayrok because a customer submitted or integrated it with the platform, that customer may be the controller of the information.

In those situations, please contact the relevant organization directly. Hayrok supports customers in responding to applicable privacy requests as required by contractual and legal obligations.