Privacy Policy
Last updated 22 September 2026
This policy explains what personal data SecurGarde ("we", "us") collects through securgarde.com and the platform at app.securgarde.com, why, and what rights you have. For personal data inside the security findings, files and records a customer puts into the platform, the customer is the controller and we process it on their instructions under our terms of service.
What we collect
- Account data: your name, work email address, company name, password (stored only as a hash) and role, and the sign-in method you use.
- Usage and audit data: significant actions in the platform are written to your organisation's audit log with your user id and a timestamp. We also keep server logs for security and troubleshooting.
- Customer content: the findings read from systems you connect, files you upload, and the risks, assessments, policies and reports you create. Cloud credentials are encrypted before storage.
- Contact data: what you send us by email, and trust-centre access requests (name, email, company, reason).
- Technical data: IP address, browser and device information, and the result of the bot check on sign-in and sign-up pages.
Why we use it
- To provide the platform to you and your organisation, which is the performance of our contract with you.
- To keep the platform secure, prevent abuse and investigate incidents, which is our legitimate interest.
- To send transactional email: confirmation, password reset, invitations, scheduled reports you configure, and trust-centre access links.
- To respond to you when you contact us.
We do not sell personal data and we do not use it for advertising.
AI features
Some features send text to a language model to produce suggestions, such as candidate controls for a finding or a narrative for a plan. Only the text needed for that request is sent, from our servers, and the model provider does not use it to train models under our agreement with them. An organisation owner can switch these features off under Settings, and the platform then works without them.
Who we share it with
Service providers who process data for us, under contract, to run the platform:
- Supabase (database, authentication, file storage, server-side functions)
- Vercel (hosting of the application)
- Resend (transactional email)
- Google (language model inference for AI features)
- Cloudflare (bot protection on sign-in and sign-up pages)
- The cloud providers whose accounts you connect (AWS, Microsoft Azure, Google Cloud), which we read from, not write to
We also disclose data where the law requires it. Some providers process data outside the UK and EU; where they do, transfers are covered by standard contractual clauses or an adequacy decision.
How long we keep it
Account and customer content for as long as your organisation has an account, and for up to 30 days afterwards to allow recovery of accidental deletion. Audit logs and server logs for up to 12 months. Email delivery records for 90 days.
Your rights
Under the UK GDPR and the EU GDPR you can ask us for a copy of your personal data, ask us to correct or delete it, object to or restrict processing, and take your data elsewhere. Write to hello@securgarde.com. You can also complain to the Information Commissioner's Office or your local supervisory authority.
Security
Every customer's records are separated at the database layer, credentials are encrypted at rest with a key held outside the database, all traffic is encrypted in transit, and access to production systems is limited to the people who operate them.
Cookies
The application uses the storage it needs to keep you signed in and to remember your preferences. The marketing site sets no cookies. The bot-protection widget on sign-in and sign-up pages may set a cookie of its own; its provider's policy applies to that.
Changes and contact
We will post changes to this policy here and, for material changes, tell account holders by email. Contact: SecurGarde, hello@securgarde.com.