What gets collected the moment you buy a managed security program, the reason it is held, which platforms handle it for us, and what you may require us to do about it.
Enterprise Secure Systems is a brand operated by Fortify 24x7. The contract with you is entered by Fortify 24x7, which retains what is described below and answers for the way all of it gets treated. Where this document says we or us, it means Fortify 24x7 acting under this brand.
This policy covers the website at enterprisesecuresystems.com, the client portal, and the managed security programs sold through them. It does not govern the separate privacy practices of any organization that links to us.
We keep the collection narrow on purpose, because data nobody holds is data nobody can lose. In practice there are four categories.
We never see, handle, or store your card number. Stripe runs the checkout and the card details go to Stripe alone. What returns to us amounts to a token, four trailing digits, the brand of card, and a yes or no on the charge.
Stripe processes payment data as an independent controller under its own terms and privacy policy. Refunds, chargebacks, and disputes run through the same channel. Your statement will carry the descriptor FORTIFY 24X7 rather than this brand name.
Each category exists for a stated reason, and we do not repurpose data collected for one into another use without telling you.
Personal information is never sold here. None of it goes to advertising networks. Nothing in the operational telemetry is turned into a marketing profile.
These programs run on established security platforms rather than tooling we wrote ourselves, and operating them means your data is processed by their vendors under contract with us. Which ones apply depends entirely on which controls you bought.
Each is engaged to deliver the service you bought and is not permitted to use your data for its own purposes. We will name the specific processors touching your account on request.
Outside the processors above, we disclose data in only three circumstances: when you direct us to, when a valid legal process compels us and we are permitted to comply, and when disclosure is necessary to protect the safety or rights of a person. Where a lawful demand for your data turns up, and nothing bars us from saying as much, you will hear about it.
If the business is ever sold or reorganized, records may transfer with it. The protections in this policy travel with them.
Operational telemetry is retained for the window the relevant platform is configured for, which varies by control and is stated during onboarding. Support correspondence is kept while your account is active and for a period afterwards so that a returning client does not have to re-explain their own history. Billing records are held for the term applicable financial and tax rules require.
When a subscription ends, agents and connectors are retired and the associated tenant data is removed on the schedule the platform provides for it. You can ask us in writing to accelerate deletion of anything not subject to a retention obligation.
Access to client data is restricted to the members of our team whose work requires it. Administrative access to the platforms is protected by multi-factor authentication, and credentials are held in a managed secret store rather than in documents, chat history, or anybody's browser.
We will not claim that any system is impossible to breach. What we will commit to is that if an incident affects your data, the people you nominated hear it from us directly and promptly, with what we know at the time rather than a delayed summary.
Ask and we will give you a copy of whatever personal information sits against your name. Ask and we will correct it, or erase anything no rule obliges us to retain, or take a nominated contact back off operational notifications. Send it to support@enterprisesecuresystems.com using an address the account already knows, and it gets verified before anybody acts.
Depending where you are located you may have additional statutory rights. We apply the handling described here to everyone regardless of jurisdiction, and we will honour a valid statutory request wherever it comes from.
This site stores your selected controls in your own browser using local storage so that a schedule survives a page reload. None of it leaves your own device before checkout. The client portal stores a session token the same way, which is removed when you sign out.
No advertising tracker and no cross-site profiling runs on this domain.
These are commercial services sold to organizations. They are not directed at children, and we do not knowingly collect personal information from anyone under sixteen. If you believe we have, tell us and it will be deleted.
A material change here revises the date printed above, and where it alters the handling of your data we tell the contacts on your account instead of trusting you to spot it.
Questions, requests, and complaints go to support@enterprisesecuresystems.com and reach a person on the Fortify 24x7 operations desk.