Privacy Policy

How we collect, use, and protect your information.

Effective Date: January 1, 2025 Last Updated: February 18, 2026

CyberHunter Solutions (“we,” “us,” or “our”) operates the SecurityBox platform and the securitybox.io website. This Privacy Policy describes how we collect, use, and protect information when you use our website and services.

Information We Collect

Information You Provide

  • Contact Information — Name, email address, phone number, and company name when you request a consultation or contact us
  • Account Information — Credentials and preferences when you access the SecurityBox platform
  • Payment Information — Billing details processed through our third-party payment provider; we do not store credit card numbers

Information Collected Automatically

  • Website Analytics — Pages visited, referral source, browser type, device type, and session duration
  • Cookies — We use essential cookies for site functionality and analytics cookies to understand usage patterns

SecurityBox Platform Data

  • Network Telemetry — When a SecurityBox sensor is deployed on your network, it processes network traffic metadata within your environment for behavioral security analysis
  • Cloud Telemetry — When SecurityBox is cloud-hosted, the platform processes logs and signals from connected cloud services (e.g., Microsoft 365, Azure AD)
  • Endpoint Telemetry — When the SentinelOne XDR add-on is active, endpoint activity data is processed for risk correlation

Important: SecurityBox processes security telemetry to generate risk assessments. We do not access, store, or transmit the content of your files, emails, or communications. All telemetry processing occurs for the sole purpose of behavioral risk analysis and threat detection.

How We Use Information

We use collected information to:

  • Deliver and operate the SecurityBox platform
  • Generate per-host risk scores, behavioral anomaly assessments, and actionable recommendations
  • Produce weekly risk trend reports and executive summaries
  • Communicate about your account, findings, and platform updates
  • Improve our platform, detection capabilities, and services
  • Respond to inquiries and support requests
  • Comply with legal obligations

Data Retention

  • Website analytics data is retained for 12 months
  • Platform telemetry and risk assessment findings are retained for the duration of your service agreement. Retention beyond that is set per customer in your service agreement; if you have a specific regulatory retention or deletion requirement, tell us before onboarding and we will configure it
  • Contact information is retained until you request deletion or 2 years after last interaction

You can request deletion of your platform data at any time, during or after the engagement, by contacting us.

Data Security

We protect your information through:

  • Encryption in transit: sensor-to-platform transfers run over SSH, and all platform-to-service API calls use TLS
  • Private network transport: platform components communicate over a WireGuard-based private network, not the public internet
  • A separate database per customer, rather than one shared multi-tenant database
  • Role-based access controls with least-privilege principles
  • Push-only sensor architecture: the sensor accepts no inbound connections from our platform
  • Regular security assessments of our own infrastructure
  • Secure deployment practices for all SecurityBox sensors

Data Sharing

We do not sell your personal information or security telemetry.

We may share information with:

  • AI model providers — SecurityBox uses large language models to reason over security telemetry and write its conclusions. Analysis context is sent to these providers over TLS. That context can include your organization name, internal host names and IP addresses, external destinations your hosts contacted, and DNS domains queried. It does not include file contents, email contents, message bodies, packet payloads, or captured credentials. The providers currently used are OpenAI (United States), xAI (United States), and Ollama Cloud (United States), which serves open-weight models including GLM and Qwen. If your environment requires that no telemetry reach a third-party model provider, our Bring Your Own AI (BYOA) deployment routes analysis to a model you control instead; ask us about it before onboarding.
  • IP reputation lookup — External (public internet) IP addresses observed in your traffic are looked up via ipinfo.io for geolocation and network ownership. Your internal addresses are not sent.
  • SentinelOne — When the XDR add-on is active, endpoint telemetry is shared with SentinelOne for threat detection, subject to their privacy policy
  • Service Providers — Third-party vendors who assist in platform operation (e.g., cloud infrastructure, payment processing), bound by confidentiality agreements
  • Legal Requirements — When required by law, legal process, or to protect our rights and the safety of our clients or the public

Data shared across our customer base

To improve detection for everyone, SecurityBox maintains a shared reference set of information about external internet infrastructure: public IP addresses, the organizations that own them, and their observed reputation. This is built from what our sensors encounter across all deployments.

Your internal telemetry is not pooled. Each customer’s hosts, findings and reports live in a database dedicated to that customer.

Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access the personal information we hold about you
  • Correct inaccurate personal information
  • Delete your personal information
  • Export your data in a portable format
  • Opt out of non-essential cookies and analytics
  • Withdraw consent where processing is based on consent

To exercise any of these rights, contact us at privacy@securitybox.io.

Children’s Privacy

Our services are designed for business use. We do not knowingly collect information from individuals under 16 years of age.

Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify active clients of material changes via email. The “Last Updated” date at the top indicates the most recent revision.

Contact

For privacy-related questions or requests: