How Security Compliance Hub collects, uses, and protects your data — including data obtained via Google Sign-In.
Effective date: 29 October 2026 · Operated by Cyber3D Ltd
Security Compliance Hub accesses only the minimum data necessary to operate. The tables below describe each category of data we collect, its source, and whether collection is required or optional.
| Data item | Source | Required? |
|---|---|---|
| Email address | Google Sign-In or direct registration | Yes — used as account identifier |
| Display name | Google profile or registration form | Optional — used for personalisation |
| User ID (UID) | Assigned by our sign-in service | Yes — internal account reference |
| Email verification status | Our sign-in service | Yes — required to enable TOTP MFA |
| TOTP multi-factor secret | Generated and stored by our sign-in service if you enable MFA | Optional — only if you enrol MFA |
| Account entitlements | Set by Cyber3D Ltd on your account (e.g. trial status, active subscription, one-shot purchases, Third Party Risk tier) | Yes — required to grant access to paid products |
email and profile). We do not request access to Gmail, Google Drive, Google Contacts, or any other Google service data.
| Data item | Purpose | Required? |
|---|---|---|
| Organisation name | Dashboard personalisation, PDF report headers | Optional |
| Industry sector | Tailored compliance guidance and recommendations | Optional |
| Organisation size | Regulatory scoping (e.g. DORA entity type) | Optional |
| Primary compliance drivers | Personalised framework recommendations | Optional |
| Data item | Purpose |
|---|---|
| Assessment question responses | Scoring, gap analysis, and AI-generated recommendations |
| Section and overall scores | Dashboard history, trend tracking, compliance readiness summary |
| Identified critical issues | Remediation planning and Phronesis AI guidance |
| Completion timestamps | Activity feed, score history ordering |
| Practitioner evidence notes (optional free-text) | Narrative context supplied by the assessor (e.g. policy references, observations). Sent to Phronesis alongside radio responses to sharpen AI-generated recommendations, and saved to your assessment record in our database so notes survive device changes and logout. CE assessments store notes via a collapsed "Add advisor notes" toggle; all other assessments show evidence fields inline. |
| Evidence Vault file attachments (optional) | Files you attach per question in the Evidence Vault (PNG, JPEG, GIF, WebP, PDF, TXT, JSON, DOCX — up to 10 MB each). Files are uploaded directly to our cloud file storage via a time-limited upload link and then scanned automatically: (1) the file's SHA-256 hash is looked up with a malware-scanning service for known-malicious signatures (only the hash is sent, never the file); (2) for files up to 512 KB, the content is inspected by an automated personal-data detection service for PII types (credit card numbers, UK National Insurance numbers, UK passport numbers, email addresses, phone numbers, and IBAN codes). Files identified as malicious or containing PII are quarantined and deleted from storage. Clean files remain in storage and are linked to your assessment record in our database. |
If you subscribe to the Third Party Risk Hub, you can add supplier records to your portfolio. We store only what is necessary to operate the questionnaire and risk-scanning features:
| Data item | Purpose |
|---|---|
| Supplier name, domain, primary contact email | Identifying the supplier in your portfolio and delivering their questionnaire invitation |
| Questionnaire responses submitted by the supplier | Scoring the supplier against your supply-chain controls |
| Risk-scan results (domain / certificate / breach-intelligence findings) | Independent verification signals that sit alongside the questionnaire score |
| Scan history, trend points, and unacknowledged alerts | Drift detection and month-on-month change tracking |
/users/{uid}/suppliers/) and are visible only to you. Deleting your account deletes all supplier records you have created. Where you add a supplier contact email so we can deliver their questionnaire, you are the controller of that email; we act as processor.
If you submit the consultancy contact form, we collect: name, email address, company name, organisation size, service of interest, and your message. This data is used solely to respond to your enquiry.
When you buy a plan online, you pay on our checkout page in a payment form provided by Stripe, our payment provider. Your card details go straight to Stripe; we never see or store them. We keep what you bought, its price, your billing name, address and VAT number, your invoices and the date you accepted our Terms of Service, so we can give you access, send VAT invoices and keep the accounting records the law requires.
If you arrived through a link from one of our partners (a reseller or consultancy that recommends us), we record which partner sent you against your account once you sign in, and the plans you then buy, so we can pay that partner their commission. We may tell the partner which plan you bought and what it cost. The record is kept on our servers, not in your browser, and is not used for anything else.
If you ask the Sales advisor (the automated assistant on our public website) a question, we keep a record of the question, the page you asked it on, whether the answer handed you to our sales team, and which of our pages the answer referred to. Email addresses and phone numbers are removed from the question before it is stored or sent to the Phronesis AI Service. We do not record your IP address, your account, or anything else that identifies you with it. We use these records to answer you and to see, in aggregate, what visitors want to know. Please don't include personal details in a question; use the Email sales button if you'd like us to contact you.
We use the data we collect solely to provide and improve the Security Compliance Hub service. We do not use your data for advertising, profiling, or sale to third parties.
| Purpose | Data used | Legal basis (UK GDPR) |
|---|---|---|
| Authenticate your account and maintain your session | Email, UID, display name | Contract performance |
| Deliver assessment scoring and gap analysis | Assessment responses, organisation profile | Contract performance |
| Generate AI-powered recommendations via Phronesis | Assessment responses, sector, org size (anonymised prompt) | Contract performance |
| Personalise your dashboard and framework guidance | Organisation profile, score history | Legitimate interests |
| Respond to consultancy enquiries | Contact form data | Consent / pre-contractual steps |
| Maintain platform security and prevent abuse | Email, UID, access logs | Legitimate interests |
| Generate anonymised sector benchmarks | SHA-256 hash of your UID plus assessment scores (no identifying fields) | Legitimate interests (you may opt out from My Hub) |
| Create a shareable read-only snapshot of your results | Scores, gap summary, Phronesis summary, organisation name | Consent (only created when you click Share) |
| Store and protect Evidence Vault file attachments | Uploaded files and their metadata | Contract performance |
| Operate the Third Party Risk Hub | Supplier records, questionnaire responses, risk-scan results | Contract performance (you) / Legitimate interests (scan of your supplier's public-domain posture) |
After you complete an assessment, your scores may be included in anonymised sector aggregates so other users in your industry can see how their organisation compares. Before the score is written we replace your UID with a SHA-256 hash, and we never store your email, organisation name, or free-text responses in the benchmark dataset. Aggregation only becomes visible when a sector reaches at least 10 contributing organisations. You can opt out at any time from the My Hub settings panel; doing so removes any future contribution and prevents the "how you compare" block from showing your results.
If you click Share on an assessment result, we create a read-only snapshot at a unique URL with a token that is unguessable. Anyone holding the URL can read the snapshot without signing in; it is therefore only as private as the link itself. You choose the expiry (7, 30, 90 days, or no expiry) and can revoke a share at any time. Shared snapshots include the overall score, section breakdowns, critical issues, strengths, next steps, and the Phronesis summary; they do not include your email, contact details, or practitioner evidence notes.
When you make a connection link to connect a tool your organisation uses, such as its email and identity service, the page it opens shows whoever has the link who asked for it. It shows your name, your email address and whether we have verified it, the organisation name on your account and, for an MSP client, the client's name. The administrator can then decide whether to continue. The link works once and for an hour, and the administrator can cancel it. Send it only to the administrator you mean to connect.
When you run an AI analysis or use the Phronesis chat feature, your assessment responses and organisation context are sent to Phronesis, our AI analysis service, to generate recommendations. This data is transmitted securely via our own servers — your data is never sent directly from your browser to Phronesis.
Across all assessments, business-attributable identifiers are stripped before any data is sent to the Phronesis AI service. This includes organisation name, target company name, assessor name, company registration number, filing status, and incorporation date. Only anonymised scores, domain context, industry sector, and organisation size are included in the analysis prompt. No information that could directly identify your organisation or any third party is transmitted to the AI.
Assessment progress is automatically saved to your browser's localStorage every second so you can resume without losing work. In addition, while you are signed in, a background draft-sync writes your in-progress state (including any evidence notes you have typed) to your private record in our database on tab-hide, page-close, and every 30 seconds if the state has changed. This cross-device sync allows you to resume on a different browser or device. The draft is deleted automatically when you complete and save an assessment. Local storage is cleared when you sign out; the saved draft persists until the assessment is completed or your account is deleted.
Key actions you take within the platform are recorded in a server-side audit log for security, integrity, and operational monitoring purposes. Logged events include: completing and saving an assessment, running a Phronesis AI analysis, starting a free trial, completing a one-shot assessment purchase, creating a share link, sending a supplier questionnaire, receiving a supplier questionnaire submission, and renaming a client in the MSP Portal. Each log entry records your user ID (UID), the action type, the assessment or product involved, and a timestamp; a client rename also records the client's old and new name. Audit log data is accessible only to Security Compliance Hub administrators and is never shared with third parties. Log entries are retained for 365 days and then deleted.
We do not sell, rent, or trade your personal data. We share data only with the service providers described below, and only to the extent necessary to deliver the platform. Our cloud infrastructure providers are described by what they do; as with our security-intelligence providers, their names are available under NDA to customers undertaking a procurement review.
| Third party | Data shared | Purpose | Location |
|---|---|---|---|
| Cloud database provider Sub-processor | Email, UID, display name, profile data, assessment scores, practitioner evidence notes, in-progress draft state, evidence file metadata (file name, size, upload timestamp, scan result) | Storing your account profile and assessment data | UK (London) |
| Cloud file storage provider Sub-processor | Evidence Vault file attachments (Assessment Bundle subscribers only) | Storing files you attach to assessment questions in the Evidence Vault | UK (London) |
| Cloud platform provider Sub-processor | The data in each request (such as your assessment answers) while our servers process it | Running the application servers that handle your requests | UK (London) |
| Sign-in and website delivery provider Sub-processor | Your sign-in details | Sign-in, and delivering the website | USA (standard contractual clauses apply) |
| Automated personal-data detection service Sub-processor | File content of Evidence Vault attachments under 512 KB (inline inspection only — file bytes are never stored by the service) | Automated PII detection — inspects uploaded files for credit card numbers, UK National Insurance numbers, UK passport numbers, email addresses, phone numbers, and IBAN codes; quarantines files that contain PII | USA (standard contractual clauses apply) |
| Malware scanning service Sub-processor | SHA-256 hash of each uploaded file only; the file itself is never sent | Malware scanning of Evidence Vault attachments; files identified as malicious are quarantined and deleted | USA (standard contractual clauses apply) |
| Phronesis AI Service Sub-processor | Assessment responses, organisation context (no direct identifiers) | AI-generated analysis and recommendations via Phronesis | USA (standard contractual clauses apply) |
| SendGrid (Twilio Inc.) Sub-processor | Contact-form submissions (name, email, message) and Third Party Risk questionnaire invitations (supplier contact email) | Transactional email delivery | USA (standard contractual clauses apply) |
| Stripe Payment provider | Name, email, billing address and VAT number, what you buy, and the card or other payment details you enter in its payment form (which we never see) | Taking payments, renewals and refunds, working out VAT, issuing invoices, and preventing fraud. For payment and fraud data Stripe acts as a controller under its own privacy policy. | USA / Ireland (standard contractual clauses apply) |
| External security-intelligence providers Sub-processors | Supplier domain / company name only (no subscriber personal data) | Independent verification signals for Third Party Risk Hub — domain reputation, breach intelligence, certificate transparency, DNS / TLS posture, public registry lookups | UK / USA / Australia (SCCs apply where relevant) |
We may disclose data where required to do so by law, court order, or regulatory authority (e.g. the ICO). We will notify you of any such disclosure unless prohibited from doing so by law.
In the event of a merger, acquisition, or sale of Cyber3D Ltd, user data may be transferred as part of that transaction. You will be notified in advance and given the opportunity to delete your account before any transfer takes effect.
User profile data and assessment scores are stored in our cloud database in London, in the UK, and the application servers that handle your requests run there too. Sign-in runs on our cloud provider's infrastructure in the USA, under standard contractual clauses.
Evidence Vault file attachments (Assessment Bundle subscribers only) are stored in our cloud file storage, also in London, in the UK, under your account's private path (evidence/{uid}/...). Storage access rules restrict reads to our own authenticated servers acting on your behalf — direct browser access to the raw storage is blocked. Each uploaded file is scanned automatically shortly after upload: its SHA-256 hash is checked against a malware-scanning service's record of known malware (the file itself is never sent), and the content is inspected by an automated personal-data detection service for PII; files that fail either check are quarantined (removed from storage and flagged in our database).
| Safeguard | Detail |
|---|---|
| Encryption in transit | All data transmitted over TLS 1.2+ (HTTPS enforced on every page and request) |
| Encryption at rest | Stored data encrypted at rest by our cloud provider (AES-256) |
| Authentication | Managed sign-in service with optional TOTP multi-factor authentication |
| Database access rules | Each user can only read their own records; all writes are performed server-side by our authenticated servers — direct client writes are blocked |
| API key protection | The Phronesis API key is kept in a managed secret store and never exposed to the browser |
| Input validation | All server endpoints validate your sign-in token and sanitise inputs before processing |
| Rate limiting | Contact-form endpoint limited to 3 requests / minute per IP address; Phronesis AI analysis limited to 20 requests / minute per authenticated user; Third Party Risk on-demand scans limited to 1 scan / 30 minutes per supplier |
Access to our cloud configuration and production data is restricted to authorised Cyber3D Ltd personnel. Service account credentials are managed through our cloud provider's access controls with least-privilege roles. Security scanning of the codebase is performed automatically on every code change via GitHub Actions (Semgrep, Trivy, Gitleaks).
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the ICO (the Information Commission's Office) within 72 hours and inform affected users without undue delay, as required under UK GDPR Article 33–34.
Security Compliance Hub uses only essential browser storage. We do not use analytics, advertising, retargeting, or social-media tracking cookies, and we do not embed third-party trackers. The one third party that sets cookies is Stripe, on the checkout page, to prevent payment fraud. The first time you visit the site you will see a one-line banner asking you to acknowledge this — you can re-open the preferences dialog at any time from the Cookie preferences link in the page footer.
| Category | Purpose | Examples | Lifetime |
|---|---|---|---|
| Essential (authentication) | Sign-in, session persistence, MFA challenge, ID-token refresh. | Sign-in session entries in IndexedDB / localStorage, set by our sign-in service's JavaScript library. | Cleared on sign-out. |
| Functional (assessment progress) | Auto-saving your in-progress answers so you can pick up where you left off, remembering whether you have dismissed dialogs (welcome modal, MFA nudge, what's-new banner, cookie banner). | crma_assessment_v1, caf_assessment_v1, dora_assessment_v1, iso27001_assessment_v1, aig_assessment_v1, cyber-essentials-assessment, pedd_assessment_v1, soc_assessment_v1, sch_onboarding_<uid>, sch_cookie_consent_v1, etc. |
Persisted on this device. Most assessment keys are cleared on sign-out; onboarding, MFA-offer and consent flags are preserved so you are not re-prompted on every login. |
| Essential (connection links) | Shows that the sign-in for a connected tool started from a connection link's page in this browser, so a link passed on without its page connects nothing. Set only when you click Continue on a connection link's page. | __session: a random value, readable only by our servers. |
One hour. |
| Essential (payments) | Fraud prevention while you pay. Set by Stripe's payment form, and only on the checkout page once the form opens. | __stripe_mid, __stripe_sid |
One year, and 30 minutes. |
| Functional (website questions) | Keeping your conversation with Phronesis on our public pages as you move between them. | sch_sales_chat_v1 in session storage. |
Only for this browser tab; gone when you close it. |
| Analytics | Not used. | — | — |
| Advertising / marketing | Not used. | — | — |
If we ever introduce usage analytics, we will bump the consent version and ask you for an explicit opt-in before any analytics storage is set. You can clear all data this site has stored in your browser at any time from Cookie preferences → Clear local data.
| Data category | Retention period | Reason |
|---|---|---|
| Account (email, UID, display name) | Until account deletion is requested | Required to provide the service |
| Organisation profile | Until account deletion is requested | Personalisation and dashboard history |
| Assessment scores & section history | Until account deletion is requested | Progress tracking, trend analysis, and sector benchmarking |
| Assessment Archive — full question-by-question record (finalised runs only) | 3 years from the date the assessment was finalised, then automatically deleted | Audit-ready evidence record for certifiers — powers the Audit Pack export and the "View completed assessment" record panel; a bounded-life working record, not permanent storage |
| Evidence Vault file attachments | Until you delete the file, your Assessment Bundle subscription lapses, or account deletion is requested | Audit-ready documentary evidence linked to individual assessment questions |
| In-progress assessment drafts (including evidence notes typed mid-assessment) | Deleted automatically on assessment completion; otherwise until account deletion | Cross-device resume of in-progress assessments |
| One-shot assessment results (CE One-Shot, PE Due Diligence, SOC Maturity) | Read-only for 30 days from analysis; then locked and removed from the active dashboard | One-shot purchases include a defined 30-day access window |
| Supplier records (Third Party Risk Hub) | Until you remove the supplier or delete your account | Ongoing portfolio risk tracking |
| Third Party Risk scan history and alerts | Until the parent supplier record is removed or your account is deleted | Drift detection and month-on-month change tracking |
| Shareable result snapshots | Expires on the date you chose when creating the share (7 / 30 / 90 days or never); revocable at any time | Public read-only snapshot for third parties you choose |
| Sector benchmark entries (hashed UID + scores) | Until account deletion is requested or you opt out of benchmarking | Anonymised aggregate statistics for the sector |
| Contact-form enquiries | Up to 24 months from submission | Business records and follow-up correspondence |
| Questions asked of the Sales advisor on our public website | 90 days, then automatically deleted | Answering the question, and seeing in aggregate what visitors ask; no IP address or account is stored with it |
| Browser localStorage data | Cleared on sign-out; otherwise persists in your browser until you clear it | Assessment auto-save (device-local only) |
| Sign-in service logs | Up to 90 days (our cloud provider's default) | Security and abuse prevention |
| Backup copies of our database (everything above that is kept in it), stored in London | Point-in-time copies: 7 days. Daily backups: 7 days. Weekly backups: 14 weeks. Then automatically deleted | Recovering data lost to a fault or a mistake. Never used for anything else, and data you asked us to delete is never restored from them |
As a UK data subject you have the right to: access your personal data, rectify inaccurate data, erasure ("right to be forgotten"), restrict processing, data portability, and object to processing based on legitimate interests. To exercise any of these rights, contact us using the details below.
If you think we have not handled your personal data properly, you can complain to us. Email support@securitycompliancehub.io with the subject line "Data Protection Complaint", or, if you are signed in, choose Support from the menu and send us the details through the form there. Tell us what happened and what you would like us to do.
We will acknowledge your complaint within 30 days of receiving it, look into it without undue delay, and tell you the outcome. You also have the right to complain to the ICO (the Information Commission's Office), the UK's data protection regulator, at any time.
You can request complete deletion of your account and all associated personal data at any time. Upon verified request we will:
Delete your sign-in account · Delete your profile and all assessment history · Delete all Evidence Vault files from storage · Delete your Third Party Risk supplier records, scans, and alerts · Revoke all active share links you have created · Remove your anonymised benchmark entries · Confirm deletion in writing within 30 days
Copies of deleted data stay in our encrypted database backups until those expire, at most 14 weeks later. They are kept only to recover from a failure, and anything you asked us to delete is left out of any recovery.
Email us at support@securitycompliancehub.io with the subject line "Data Deletion Request" and the email address associated with your account. We will verify your identity before processing the request.
For general privacy enquiries or to exercise other UK GDPR rights, contact support@securitycompliancehub.io. To complain about how we use your data, see Complaints About How We Use Your Data above. You also have the right to lodge a complaint with the ICO (the Information Commission's Office).