This policy explains how Trenchant Labs LLC (“Trenchant”, “we”) handles personal information through this website and the Trenchant Countersign service. Contact us at [privacy@trenchantlabs.com].
1. Two different roles
- As a controller, for the people who visit this website, contact us, request access or a licence, and the administrators who manage a customer account with us.
- As a processor, for the personal information inside a customer's tenant: tickets, users, configuration items and the records the service writes. The customer decides what that data is and why it is processed. Our Data Processing Addendum governs it, and questions about it should go first to the organisation that uses the service.
2. What we collect as a controller
- Enquiry forms: name, work email, organisation, role, organisation size, deployment and timing preferences, the frameworks you answer to, and anything you write in the free-text fields. These are stored in our service's database and a notification is emailed to our sales team.
- Email: what you send to sales, support, security or privacy addresses.
- Customer account administration: contact details of the people who sign up, sign contracts and pay for the service, and billing records.
- Security records: when you use the service, sign-in events and the requests needed to keep it secure.
3. This website
This website sets no cookies and uses no analytics or advertising trackers. It loads fonts from Google Fonts, so your browser contacts Google when you visit. [Remove this sentence if fonts are self-hosted.]
4. Why we use it, and our legal bases
- To answer your enquiry and set up a trial or contract (steps before entering a contract, or legitimate interests).
- To provide, secure and support the service (performance of a contract, legitimate interests).
- To invoice and keep financial records (legal obligation).
- To tell you about changes to the service or these documents (legitimate interests). We do not send marketing email without consent where consent is required.
We do not sell personal information and do not share it for cross-context behavioural advertising.
5. Who we share it with
Service providers that host and run the service and our email, listed on our sub-processors page, under contracts that limit their use of it. We disclose information where law requires or to protect our rights and the security of the service. If Trenchant is sold or merged, information transfers with the business under this policy.
6. How long we keep it
- Enquiries: [N months] after our last contact, unless you become a customer.
- Customer account and billing records: for the contract and [N years] afterwards, as tax law requires.
- Inside the service (processor role), by default: security events 365 days; agent usage records 730 days; the evidence trail of workflow decisions for the life of the tenant, because it is the audit record. Customer Data is deleted after a contract ends as set out in the Terms.
7. Where it is stored
The cloud service and our enquiry records are hosted by Google Cloud in the United States (us-central1). Where we transfer personal information from the EU, EEA, UK or Switzerland, we rely on [Standard Contractual Clauses / the Data Privacy Framework].
8. Your rights
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict its use, and to complain to a data protection authority. California residents have the rights given by the CCPA/CPRA, including to know, delete and correct, and not to be discriminated against for using them. Write to [privacy@trenchantlabs.com]; we will verify the request and answer within the time the law sets. If your information is in a customer's tenant, we will pass your request to that customer.
9. Security
Customer tenants are isolated in the database by row-level security, credentials are stored by reference in a secret manager rather than in the database, sign-in supports single sign-on and authenticator-app codes, and an append-only audit trail records administrative actions. No system is perfectly secure; we will notify affected people and authorities of a breach as law requires.
10. Children
The website and the service are for businesses and are not directed at children under 16.
11. Changes
We will post changes here and update the date above. Material changes will be notified to customers by email.