Privacy policy for CyVigilant.

Overview

CyVigilant Technologies Private Limited ("CyVigilant", "we", "us", or "our") operates the CyVigilant brand, which provides enterprise security-assessment services including VAPT, penetration testing, CERT-In audits (delivered via empanelled partners), red team assessments, secure code review, and security architecture review. This Privacy Policy explains how we collect, use, disclose, and protect information when you engage with our services, visit our website (cyvigilant.com), or contact our team.

By using this website or engaging CyVigilant for an assessment, you acknowledge you have read and understood this policy. If you do not agree, please discontinue use of our website and do not submit inquiry forms.

Information We Collect

Inquiry and Contact Data

When you submit an inquiry form, request a scoping call, or contact us by email, we collect your name, business email address, company name, job title, phone number, and the nature of your security requirement. This information is used to respond to your inquiry, scope an engagement, and issue proposals.

Engagement and Assessment Data

During an active security-assessment engagement, we may collect or generate IP addresses, hostnames, application URLs, network diagrams, system configurations, and vulnerability evidence within the explicitly agreed scope and rules of engagement. All testing targets must be systems you own or have written authorization to test.

Website Usage Data

We collect standard web server logs including IP addresses, browser type, operating system, referring URLs, pages visited, and access timestamps when you visit cyvigilant.com. This data is used for security monitoring and website performance analytics.

How We Use Your Information

We use collected information to: (a) respond to inquiries and scope security-assessment engagements; (b) execute contracted assessments within the agreed rules of engagement; (c) deliver findings reports, executive summaries, and, where applicable, CERT-In Safe-to-Host certificates obtained via our empanelled partners; (d) send transactional communications related to your engagement; (e) comply with legal obligations including CERT-In reporting requirements; (f) improve our services and website.

Data Sharing and Disclosure

We do not sell your personal information. We may share data with: (a) sub-contractors and specialist testers engaged to deliver specific assessment components, under strict confidentiality agreements and limited to the data required; (b) our CERT-In empanelled audit partners, or CERT-In or other Indian regulatory authorities, where required by law or as part of the audit process; (c) law enforcement or courts when required by applicable Indian law; (d) parties involved in a business transfer or acquisition, with advance notice.

Data Retention

Inquiry and contact records are retained for 12 months after the date of last contact unless an engagement follows. Engagement deliverables — reports, evidence packages, and correspondence — are retained for 36 months from engagement close to support regulatory inquiries and warranty obligations. You may request deletion of your data at any time by writing to privacy@cyvigilant.com; we will confirm deletion within 30 days subject to any legal or regulatory retention requirements.

Your Rights

Under the Digital Personal Data Protection Act 2023 (DPDP Act) and other applicable laws, you may have the right to: access your personal data; correct inaccuracies; request erasure; restrict processing; and file a complaint with the Data Protection Board of India. To exercise any right, contact: privacy@cyvigilant.com. We will respond within 30 days.

Cookies and Tracking

Our website uses essential cookies for functionality and optional analytics cookies to understand site usage. We do not use advertising or behavioural-tracking technologies. You can manage cookie preferences through your browser settings.

Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, regulatory obligations, or services. Material changes will be notified via a notice on this page at least 14 days before they take effect. The date at the top of this page reflects the most recent update.

Contact

For privacy enquiries, contact CyVigilant Technologies Private Limited, Data Protection Team: privacy@cyvigilant.com. For security-related concerns: security@cyvigilant.com.