Privacy statement

In this statement, personal data means any information relating to an identified or identifiable individual, such as a name, email address, telephone number, job title, or an online identifier such as an IP address.

We do not seek to collect sensitive categories of personal data, such as health information, government identification numbers, or information about a person's beliefs or background. Our site has free-text fields in which you could enter such information. Please do not. If you provide it anyway, we will use it only to respond to you and will delete it once the inquiry is closed.

You have the following rights in relation to your personal data, subject to applicable law:

• To access the personal data we hold about you
• To have your personal data corrected if it is incomplete or inaccurate
• To ask us to delete your personal data, or to restrict or object to how we use it
• To opt out of any marketing communications at any time
• To receive a copy of the personal data you provided to us in a commonly used format
• Where processing is based on your consent, to withdraw that consent

To exercise any of these rights, email info@ci-discern.com. We respond within two business days and complete requests within 30 days where the law allows. Depending on where you live, you may have additional rights under state or national privacy law; we will honor them as they apply. We do not sell personal data or share it for cross-context behavioral advertising, so there is no sale or sharing to opt out of, and browser signals such as Global Privacy Control change nothing.

Information that you provide

When you use the contact form or email us from the site, we receive the information you choose to provide: your name, organization, title, work email address, telephone number, sector, area of interest, and your message.

This site is for general business inquiries. Do not submit confidential, proprietary, export-controlled, or classified information, or Controlled Unclassified Information, through the contact form or by unsolicited email. We will arrange a secure channel for any engagement that requires one.

Information that we collect automatically

Our hosting provider, Cloudflare, processes standard connection data when you visit the site, such as your IP address, browser type, device type, and the pages requested, in order to deliver the site and protect it from abuse. We use Cloudflare Web Analytics to understand which pages are visited and how the site performs. It does not use cookies, does not build a profile of individual visitors, and does not track you across other sites. This site sets no advertising or tracking cookies.

Purposes for which we process personal data of visitors

• To respond to your inquiry and follow up on a potential engagement
• To administer, secure, and improve the site
• To understand which content is of interest to visitors, in aggregate
• Any other purpose for which you provided the information

Our basis for processing personal data of visitors

• Our legitimate interest in responding to inquiries and operating the site securely and effectively
• Your consent, where you choose to provide information through the contact form

When you or your organization engages us, or discusses a potential engagement with us, we collect and use personal data where we have a valid business reason to do so. This information is generally supplied by you or your organization and includes:

• Basic information, such as your name, the organization you work for, and your position
• Contact information, such as your business address, email address, and telephone numbers
• Information needed to agree on and administer the engagement, such as billing contacts
• Any other personal data you provide to us for the purpose of receiving our services

We use this information to scope and provide services, to administer our relationship and contracts, for accounting and invoicing, to comply with legal and professional obligations, to establish or defend legal rights, and to keep you informed about our work where you have agreed to that. Before accepting an engagement we may also check for conflicts of interest and confirm eligibility requirements that apply to work for government or defense clients.

Our basis for processing personal data of clients

• Performance of a contract, or steps taken at your request before entering into one
• Compliance with legal, regulatory, or contractual obligations
• Our legitimate interest in providing consistent, high-quality services and in managing our business relationships

In the course of assessments, architecture reviews, governance programs, tabletop exercises, and similar engagements, we may receive personal data about people with whom we have no direct relationship, such as a client's employees, contractors, vendors, or system users. Examples include names and roles in organization charts and access reviews, contact details in incident response plans, user identifiers in system logs and configuration files, and participant lists for exercises and interviews.

We use this data only to perform the services our client has engaged us for. We ask our clients to confirm that they are entitled to share it with us, we handle it under the confidentiality terms of each engagement, and we return or destroy it at the end of the engagement in accordance with those terms unless we are required to retain it.

Our basis for processing

• Performance of our contract with the client
• Compliance with legal or regulatory obligations
• Our legitimate interest in delivering the services our clients have engaged us to perform

We keep records of former, existing, and prospective clients, partner firms, and other business contacts, such as regulators, industry groups, and conference organizers. These records contain names, job titles, organizations, business contact details, and notes on our interactions. We use them to maintain relationships and, where you have agreed, to share information about our services, publications, and events. You can ask us to stop at any time by emailing info@ci-discern.com, and we will keep your basic details on a suppression list so that we do not contact you again.

Our basis for processing

• Our legitimate interest in managing relationships with our business contacts and informing them about our work
• Your consent, where you have asked to receive communications from us

We hold meetings with clients, prospective clients, and partner firms in person and through conference and collaboration platforms. For virtual meetings we process the information those platforms require, such as your name, email address, organization, and device and connection data, along with anything you share during the meeting.

We record or transcribe a meeting only with the knowledge of all participants, and we will tell you before any recording or transcription begins so that you can choose not to participate. Recordings and transcripts are kept only as long as needed for the purpose of the meeting and are handled under the confidentiality terms of the relevant engagement.

Our basis for processing

• Our legitimate interest in conducting meetings to provide our services and maintain our business relationships
• Your consent, for any recording or transcription

If you correspond with us by email, your messages and attachments are processed by the security tools that protect our email system, which may scan content for malicious attachments and links. This means content may be reviewed by authorized CI-Discern personnel other than the intended recipient when a security alert requires it.

Our basis for processing

• Our legitimate interest in protecting our systems and information against unauthorized access and data loss

If you apply to work with CI-Discern, we collect the information you provide, such as your resume, work history, qualifications, and references, together with notes from interviews and any assessments. We use this information to evaluate your application and, if we make you an offer, to carry out the pre-employment checks that apply to our work, which can include verification of security clearances where a role requires one. We keep unsuccessful applications for [retention period for applications] unless you ask us to delete them sooner.

Our basis for processing

• Steps taken at your request before entering into a contract
• Our legitimate interest in attracting, assessing, and hiring qualified people
• Compliance with legal obligations, including eligibility and clearance requirements

We process personal data about the people at our suppliers, subcontractors, and partner firms, including the external firms that deliver penetration testing within our engagements. This is generally limited to business contact details and payment information. We use it to manage our contracts and relationships, to receive and pay for services, and to confirm that no conflict of interest or client eligibility requirement prevents us from working together.

Our basis for processing

• Performance of a contract
• Compliance with legal, regulatory, or client contractual obligations
• Our legitimate interest in managing payments and our supplier relationships

CI-Discern operates in the United States, and the personal data described in this statement is processed and stored here. We use a small number of service providers that act on our instructions: Cloudflare hosts the site and provides analytics; [form provider name] processes contact form submissions and delivers them to our email; [email and collaboration provider] hosts our email, documents, and virtual meetings; and Google Fonts supplies the typefaces for the site, which means your browser requests font files from Google when a page loads. We use only providers that commit to appropriate confidentiality and security, and we do not permit them to use personal data for their own purposes.

If you contact us from outside the United States, your personal data will be transferred to and processed in the United States.

We disclose personal data:

• Where appropriate for the purposes described in this statement
• Where required by applicable law, a court order, or a regulatory or government inquiry
• In connection with a reorganization, merger, or sale of our business
• Where we believe disclosure is appropriate to enforce our terms of engagement or protect the rights, property, or safety of CI-Discern, our clients, or others
• With your consent

Recipients may include our professional advisors, such as attorneys, accountants, and insurers; our service providers; and courts, law enforcement, or government agencies where the law requires.

CI-Discern protects the confidentiality and security of the information it obtains in the course of its business. Access to personal data is limited to the people who need it, our business systems require multi-factor authentication, and this site is served only over encrypted connections, hosts no customer accounts or databases, and applies browser security protections on every page. No method of transmission or storage is perfectly secure, which is one reason we ask you not to send sensitive information through the site.

We retain personal data only for as long as it is needed for the purposes described in this statement, or as required by law, regulation, or our contracts with clients. Website inquiries that do not lead to an engagement are deleted after [retention period]. Information relating to an engagement is kept for the duration of the engagement and for the period that follows under our professional and contractual obligations, and is then deleted or returned.

We aim to keep the personal data we hold accurate and complete. If your contact details or other information change, let the person you deal with at CI-Discern know, or email info@ci-discern.com.

Our site is not intended for use by minors under the age of 16. We do not knowingly collect personal data from anyone under 16 through our site. If you believe a minor has provided personal data to us, contact us and we will delete it.

If you have a question or concern about how we handle personal data, contact info@ci-discern.com and a member of our leadership team will look into it and tell you how it will be handled. Depending on where you live, you may also have the right to lodge a complaint with a data protection or consumer protection authority.

We will update this statement from time to time to reflect changes in our practices or services. When we do, we revise the "last updated" date at the top. If we make material changes to how we collect, use, or share personal data, we will post a prominent notice on the site. We recommend checking this page periodically.