Privacy
Privacy policy
This page describes processing performed by the Cyberhack Platform website and authenticated workspace, based on the current technical implementation. It is not legal advice.
TODO (legal/business): complete controller identity, DPO contact, retention schedules, processor list, and international transfer safeguards before treating this page as final.
Data controller
TODO: legal name, legal form, registered office, and registration identifiers of the controller operating Cyberhack Platform. Pending business validation — do not invent company details.
Contact and DPO
Product/access contact used in the product: contact@cyberhack.fr (account) and tickets@cyberhack.fr (support). TODO: designate and publish a privacy/DPO contact if applicable.
Categories of personal data
Depending on use: account identifiers (email, name), authentication and MFA metadata, organisation/tenant membership, support tickets, questionnaire answers submitted when requesting access, operational security telemetry published into a tenant workspace, and technical logs (see cookie policy for browser storage). Do not paste secrets into free-text fields.
Purposes
Provide invite-based access to the platform; authenticate users; deliver contracted security services in a tenant-isolated workspace; process support requests; improve reliability and security of the service; respond to access requests from prospects via the public questionnaire.
Legal bases
TODO (legal validation): map each purpose to contract performance, legitimate interest, legal obligation, and/or consent (e.g. optional preference storage, future analytics). Authentication and service delivery typically rely on contract/legitimate interest; optional trackers rely on consent where required by ePrivacy / Article 82.
Recipients and processors
Cyberhack operators with role-based access; infrastructure processors (hosting, email, object storage, optional SSO IdP) under the deployment configuration. TODO: publish the current processor list for production.
International transfers
TODO: document whether any processing occurs outside the EU/EEA and which safeguards apply (SCCs, adequacy, etc.). Build-time font downloads may contact Google during CI/build — runtime fonts are self-hosted by Next.js.
Retention
TODO (legal/business): define retention for accounts, tickets, audit logs, backups, and questionnaire emails. Consent choices are stored about six months in the browser then re-prompted. Session tokens follow configured JWT TTLs.
Your rights
Under the GDPR you may have rights of access, rectification, erasure, restriction, objection, and portability where applicable. Contact the controller (TODO) to exercise them. Invite-only accounts are managed by Cyberhack operators.
Withdrawing consent
Where processing is based on consent (optional cookie categories), use “Manage cookies” in the footer to change or refuse optional trackers at any time.
Complaint to the CNIL
You may lodge a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL) — https://www.cnil.fr/
Automated decision-making
The public questionnaire provides indicative coverage suggestions only; it does not produce automated decisions producing legal effects. Platform scoring and findings are evidence-based operational outputs for human review — not profiling for advertising.
Security
Controls include HTTPS in production (COOKIE_SECURE), HttpOnly session cookies, SameSite=Lax, tenant isolation, RBAC, and audit of sensitive actions. Residual risk remains; report security issues via your Cyberhack contact channel.
Version
Privacy policy technical draft aligned with consent model 2026-02. Update this date when legal content is finalised.