Privacy Policy

DomeSOC ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains what data we collect, how we use it, and your rights regarding your data.

1. What Data We Collect

Data Type	What It Includes	Why We Collect It
Account data	Name, email, company name, password (hashed)	To create and manage your account
Security event data	IP addresses, hostnames, usernames, event types, timestamps sent via your SIEM or agent	To provide threat detection and analysis
Usage data	Detection counts, SOAR actions taken, API key usage	To enforce plan limits and improve the service
Agent data	Hostname, OS, network connections, process names from installed agents	To provide endpoint monitoring
Payment data	Handled entirely by Stripe — we never see full card numbers	To process subscriptions

2. What We Do NOT Collect

• Keystroke logs or screen recordings
• Personal files or document contents
• Passwords or credentials from monitored systems
• Personal communications (email content, chat messages)
• Any data beyond security events and system metadata

3. How We Use Your Data

• Analyze security events to detect threats using AI
• Execute SOAR actions you have configured
• Generate weekly security reports
• Send alerts and notifications you have enabled
• Improve detection accuracy and AI model performance
• Provide customer support

4. Data Retention

Security event data and detections are retained for 90 days by default. Incidents and audit logs are retained for 1 year. Account data is retained until account deletion plus 30 days. You can request earlier deletion by contacting hello@domesoc.com.

5. Data Sharing

We do not sell your data. We share data only with:

• Supabase — database hosting (data stored in US)
• Railway — backend hosting (data processed in US)
• Anthropic (Claude) — AI analysis of security events (no data retained by Anthropic per their API terms)
• Resend — email delivery for alerts and reports
• Stripe — payment processing
• VirusTotal — IP reputation lookups (only source IPs shared, no customer-identifying data)

6. Security

All data is transmitted over HTTPS/TLS. API keys are stored hashed. Passwords are bcrypt hashed with salt rounds of 12. We do not store plaintext credentials of any kind. Security events are logically isolated per tenant — your data is never accessible to other customers.

7. Your Rights

You have the right to:

• Access all data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Export your detection and incident data
• Opt out of AI model training (contact us to request this)

To exercise any of these rights, email hello@domesoc.com

8. Cookies

The DomeSOC web application uses localStorage (not cookies) to store your authentication token locally in your browser. No third-party tracking cookies are used. The landing page (domesoc.com) does not use any tracking or analytics cookies.

9. Children

DomeSOC is a B2B security platform intended for use by businesses and security professionals. We do not knowingly collect data from individuals under 18 years of age.

10. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by email. The date at the top of this page reflects the most recent update.

11. Contact

Privacy questions or requests: hello@domesoc.com