Privacy Policy

1. Introduction

ExodusSec ("we," "us," or "our") is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information in accordance with the laws of the State of New York, including the New York SHIELD Act, and other applicable U.S. federal and state privacy legislation.

As a cybersecurity and penetration testing company headquartered in New York, we understand the critical importance of data protection and handle all information with the highest standards of security and confidentiality.

2. Information We Collect

2.1 Personal Information

We may collect the following types of personal information:

• Contact details including name, email address, phone number, and business address
• Company name, position, and professional role
• Technical information about your IT infrastructure and systems (with your explicit consent)
• Payment and billing information
• Communications and correspondence with our team
• Website usage data and analytics information
• IP addresses and device information

2.2 Sensitive Information

During the course of providing penetration testing and security assessment services, we may collect or access sensitive information, including:

• Network architecture and security configurations
• System vulnerabilities and security weaknesses
• Access credentials (handled under strict security protocols)
• Business-critical data discovered during security assessments

All sensitive information is collected only with your explicit consent and is handled in accordance with our strict security protocols and contractual obligations.

3. How We Collect Information

We collect information through various means:

• Direct interactions when you contact us, request services, or engage our team
• Website forms, contact pages, and service request submissions
• Email, phone, and in-person communications
• During the provision of penetration testing and security services
• Automated technologies including cookies and analytics tools on our website
• Publicly available sources for open-source intelligence (OSINT) activities when authorized

4. How We Use Your Information

We use your personal information for the following purposes:

• Providing penetration testing, security assessments, and related cybersecurity services
• Communicating with you about our services, projects, and engagements
• Processing payments and managing billing
• Improving our services and developing new security solutions
• Complying with legal and regulatory requirements
• Maintaining records and documentation of our services
• Marketing our services (only with your consent and in accordance with the CAN-SPAM Act)
• Responding to inquiries and providing customer support

5. Disclosure of Information

We may disclose your personal information to:

• Service providers and contractors who assist in delivering our services (under strict confidentiality agreements)
• Cloud service providers for secure data storage and processing (U.S.-based where possible)
• Professional advisors including lawyers, accountants, and auditors
• Law enforcement, government agencies, or regulatory bodies when legally required
• Third parties with your explicit consent

We do not sell, rent, or trade your personal information to third parties for marketing purposes. All third-party service providers are required to handle your information in accordance with applicable U.S. and New York privacy laws and are contractually bound to maintain confidentiality.

6. Data Security

As a cybersecurity company, we implement industry-leading security measures to protect your information, consistent with the "reasonable safeguards" standard required under the New York SHIELD Act:

• End-to-end encryption for data transmission and storage
• Multi-factor authentication and access controls
• Regular security audits and vulnerability assessments of our own systems
• Strict data retention and destruction policies
• Employee training on data security and privacy obligations
• Secure destruction of physical and electronic records when no longer required
• Written incident response procedures in the event of a data breach

In accordance with the New York SHIELD Act and New York General Business Law § 899-aa, we will notify affected individuals and, where required, the New York Attorney General, the New York Department of State, and the New York State Police, in the event of a qualifying data breach involving private information.

7. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, comply with our legal obligations, resolve disputes, and enforce our agreements. Specific retention periods include:

• Client engagement records: 7 years (in accordance with New York and federal record-keeping requirements)
• Penetration testing reports and findings: duration specified in service agreements, typically 5–7 years
• Marketing communications data: until you withdraw consent or request deletion
• Financial records: 7 years, as required for federal and New York State tax purposes

8. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access: You can request access to the personal information we hold about you
• Correction: You can request correction of inaccurate or incomplete information
• Deletion: You can request deletion of your personal information (subject to legal obligations)
• Objection: You can object to the processing of your information for direct marketing purposes
• Complaint: You can lodge a complaint about our handling of your personal information
• Anonymity: Where practical, you have the option to interact with us anonymously or using a pseudonym

To exercise any of these rights, please contact our Privacy Officer using the details provided below. We will respond to your request within a reasonable time, and in any event within 30 days where required by applicable law.

9. Cross-Border Data Transfers

We primarily store and process data within the United States. However, in some circumstances, we may transfer personal information to recipients outside the United States, including:

• Cloud service providers with data centers outside the United States
• International technology partners and security tools (when necessary for service delivery)

When transferring data internationally, we take reasonable steps to ensure that recipients handle your information with protections consistent with this Policy, or we obtain your consent for such transfers.

10. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to enhance your browsing experience and analyze website traffic. We use:

• Essential cookies: Required for website functionality
• Analytics cookies: To understand how visitors use our website (Google Analytics)
• Marketing cookies: To deliver relevant content (only with your consent)

You can control cookie preferences through your browser settings. However, disabling certain cookies may affect website functionality.

11. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage you to review the privacy policies of any third-party websites you visit.

12. Children's Privacy

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete such information promptly, consistent with the federal Children's Online Privacy Protection Act (COPPA) where applicable.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by:

• Posting the updated policy on our website with a new "Last Updated" date
• Sending an email notification to registered clients (for significant changes)
• Displaying a prominent notice on our website

Your continued use of our services after any changes indicates your acceptance of the updated Privacy Policy.

14. Complaints and Disputes

If you have a complaint about how we have handled your personal information, please contact our Privacy Officer using the details below. We will:

• Acknowledge your complaint within 7 days
• Investigate the matter thoroughly
• Provide a written response within 30 days

If you are not satisfied with our response, you have the right to lodge a complaint with the New York State Attorney General's Office:

• Website: ag.ny.gov
• Consumer Help Line: (800) 771-7755
• Address: New York State Office of the Attorney General, 28 Liberty Street, New York, NY 10005