Privacy Policy

Effective Date: 2026-01-01 · Last updated: June 7, 2026

This Privacy Policy explains how AlistoIR Enterprise ("we", "us", "Company") collects, uses, stores, and protects personal data when you use our Security Orchestration, Automation and Response (SOAR) platform. We comply with the Philippine Data Privacy Act of 2012 (RA 10173) and its Implementing Rules and Regulations.

1. Data Controller

AJMX IT Security is the personal information controller (PIC) for data processed through AlistoIR Enterprise. You may contact our Data Protection Officer at [email protected].

2. Data We Collect

Category	Examples	Purpose
Account Data	Name, work email, password (hashed)	Authentication, account management
Organization Data	Company name, industry, Wazuh config	Tenant provisioning
Security Telemetry	Alert data, IP addresses, file hashes, hostnames	Core SOAR functionality
Usage Data	Login timestamps, feature usage, alert counts	Subscription enforcement, billing, analytics
Support Data	Messages, attachments shared in support requests	Customer support
Technical Data	Browser type, IP address, session ID	Security, fraud prevention

3. How We Use Your Data

To provide, operate, and improve the SOAR platform
To authenticate users and enforce access controls
To send account notifications, security alerts, and service updates
To enforce subscription limits and billing
To detect and prevent unauthorized access or abuse
To comply with legal obligations

4. Security Telemetry — Special Handling

Security telemetry (alerts, IOCs, artifacts, evidence files) is treated as highly sensitive. It is:

Stored only in your organization's isolated tenant partition
Never shared with other tenants or used for platform-wide analytics
Stored outside the web root in an encrypted-at-rest directory (/var/alistoir/)
Accessible only to users you authorize within your organization
Transmitted only to threat intelligence APIs you configure (VirusTotal, AbuseIPDB, etc.) — we do not add your data to platform-wide TI lookups

5. Data Sharing

We do not sell your personal data. We may share data with:

Threat Intelligence Providers — only when you configure your own API keys and explicitly trigger enrichment
Infrastructure Providers — cloud hosting, email delivery, under confidentiality agreements
Legal Authorities — when required by Philippine law or valid court order

6. Data Retention

Account data is retained for the duration of your subscription plus 30 days after cancellation (export window). Security telemetry is retained according to your organization's configured retention settings. You may request deletion at any time by contacting us.

7. Your Rights (RA 10173)

Under the Philippine Data Privacy Act, you have the right to:

Access — request a copy of your personal data
Rectification — correct inaccurate data
Erasure — request deletion of your data
Data Portability — receive your data in a machine-readable format
Object — opt out of processing for direct marketing
Complain — file a complaint with the National Privacy Commission (NPC)

To exercise these rights, contact [email protected].

8. Security Measures

We implement the following technical safeguards:

HTTPS/TLS for all data in transit
Tenant data isolation — no cross-tenant data access
Files stored outside the web root (not directly accessible via URL)
Role-based access control with mandatory 2FA option
Platform audit logging for all privileged actions
Encrypted storage of API credentials and passwords

9. Cookies

We use only essential session cookies required for authentication. We do not use tracking cookies or third-party analytics cookies. The visitor counter on our homepage uses anonymized, aggregated data only.

10. Changes to This Policy

We will notify registered users by email at least 14 days before any material change to this Privacy Policy. Continued use after the effective date constitutes acceptance.

11. Contact & Data Protection Officer

Privacy inquiries: [email protected]
Security vulnerabilities: [email protected]