Last updated 28 July 2026
1. Scope
This policy explains what personal data CISO.aero collects when you use the platform, why it is held, and how long it is kept. It applies to the CISO.aero application and its supporting services.
2. Data we collect
Account records: your first and last name, username, email address, the organization you belong to, your assigned role and your account status. Passwords are stored only as a one-way hash and are never held in readable form.
Authentication records: session identifiers, the time of your last sign-in, password reset requests and their expiry, and whether a password change is required.
Client program data: the compliance, risk, assessment and evidence records that your organization enters into the platform.
3. How data is used
To authenticate you, to enforce access control, to operate the compliance and reporting features you use, to send transactional email such as password resets, and to maintain security and audit records.
4. Legal basis
Processing is carried out to perform the contract between your organization and CISO.aero, and to meet our legitimate interest in operating and securing the service.
5. Sharing
Data is not sold. It is shared only with the infrastructure and email providers required to deliver the service, and where disclosure is required by law.
6. Retention
Account and program data is retained for the life of your organization's agreement and for the period afterwards required by applicable record-keeping obligations. Password reset tokens expire one hour after issue and are single use.
7. Your rights
Depending on your jurisdiction you may request access to, correction of, or deletion of your personal data, and may object to or restrict certain processing. Requests are handled through your organization's administrator.
8. Security
Access is restricted by role, transport is encrypted, passwords are hashed, and administrative access to client data is logged.
9. Contact
Questions about this policy should be directed to your organization's administrator or to the CISO.aero support address.
