Privacy Notice

This matters more than it sounds, because our obligations differ.

If you signed up, or you administer an account, we are the data controller for your name, work email, organization and the record of what you did on the platform. This notice is our notice to you.

If your employer put you on Seraph CTI as a member of staff to be trained, your employer is the controller and we are their processor. We act on their instructions. Your rights are exercised against them, and we help them answer you — the terms are in the Data Processing Addendum. If you contact us directly, we will pass your request to your employer and tell you we have.

Seraph Cyber Limited, Enwealth Business Centre, Ngong Lane, Nairobi, Kenya. For anything in this notice, write to privacy@seraphcyber.com.

[TO CONFIRM: whether Seraph Cyber is registered with the Office of the Data Protection Commissioner, and its registration number]

When you enquire or sign up: your name, work email, organization name and the headcount you told us, plus the IP address and browser the request came from. We keep the last two for abuse review, because a form that provisions accounts is worth being able to look back at. Our basis is taking steps to enter into a contract at your request, and our legitimate interest in preventing abuse.

When you use the platform as an administrator: your account details, your sign-ins including whether they used SSO or MFA, and the administrative actions you take. Our basis is performing the contract, and our legitimate interest in a security audit trail.

When we bill you: billing contact details, your KRA PIN where you give it, invoices, payments and their references. Our basis is performing the contract and complying with tax law.

Staff loaded by your employer: name, work email, department or group, and the record of how they responded to simulations and training. We process this on your employer’s instruction, not our own.

Breach-exposure monitoring, where your package includes it: we check staff addresses against breach and infostealer corpora. Recovered password values are read only to set an exposure flag and are discarded at the boundary — only the names of the exposed fields are stored. We never hold a recovered credential.

We do not sell personal data. We do not use your data or your staff’s data to train machine-learning models. We do not run advertising on the platform, and we do not use third-party advertising or analytics trackers on it.

Reports your staff submit through the report button feed a regional threat picture shared with other customers. What is shared is the threat itself — the lure, the sending infrastructure, the technique. Your organization is not named and the reporter is not identified.

These are our sub-processors. Each receives only what its purpose needs, and the ones marked optional can be switched off without losing the core product.

We also query public catalogues — NVD (vulnerability catalogue), CISA Known Exploited Vulnerabilities, VirusTotal, urlscan.io — for vulnerability and threat data. No personal data is sent to any of them, which is why they are not in the table above.

We will tell customers before adding a sub-processor that receives personal data.

The platform and its backups run on [TO CONFIRM: hosting provider and the country its data centre is in].

Some sub-processors above are outside Kenya. Where personal data is transferred out of Kenya we rely on the safeguards in section 49 of the Data Protection Act, and we will provide details of the safeguard used on request.

These are the windows the platform actually enforces, by scheduled job. Where a window is configurable by the customer, the default is given.

Encrypted in transit, hard tenant isolation enforced at the query layer, multi-factor authentication, passwords stored only as adaptive one-way hashes, API keys stored hashed and individually revocable, and an audit log of security-relevant events. The detail is on our Trust & Security page, which describes only things the platform actually does.

Under the Data Protection Act 2019 you may ask to see the personal data we hold about you, to have it corrected, to have it erased, to restrict or object to how we use it, and to receive it in a portable form. You may also complain to the Office of the Data Protection Commissioner.

Write to privacy@seraphcyber.com. We will respond within the statutory period. If you are a member of staff on a customer’s account, see clause 1 — we will route your request to your employer, which is the fastest way to get it answered.

Erasing a staff member anonymizes their records after a 30-day grace period. The grace exists so an erasure made in error can be recalled; after it, the anonymization cannot be undone. Invoices and payment records are not erased — we are required to keep them.

The marketing site sets no cookies and carries no third-party analytics or advertising trackers. The application behind sign-in uses only what is strictly necessary to keep you signed in and to protect the session. There is nothing here to opt out of, which is why you have not been shown a banner.

Each version of this notice carries a version number and effective date at the top. If we make a material change we will tell account administrators before it takes effect.