Privacy notice
What personal data InfoSec247 handles, why, where it lives, and what you can ask us to do about it. Written to be read, not to be survived.
1. Who we are
InfoSec247 is an information security incident management service operated by Max Impact Services Limited T/A InfoSec247, a company registered in United Kingdom under number 09707999..
In this notice, “we”, “us” and “our” mean that company. “You” means whoever is reading it — a visitor to our website, someone evaluating the product, or a named user of the application.
How to reach us about privacy:
By email
ICO registration
ICO:00011665265
2. Controller or processor — which applies
This distinction matters, because it changes who you should ask about what.
We are the controller for
Account details of the people who sign in to InfoSec247.
Enquiries sent to us through the website or by email.
Billing and subscription records for the organisation.
Service logs we generate to keep the platform running and secure.
We are a processor for
Everything our customers put into the application: incident records, timeline notes, uploaded evidence, asset and client registers, corrective actions and root cause analyses. We call this customer content.
For customer content, the customer organisation is the controller and decides what goes in, who may see it and how long it is kept. We only act on their instructions. If you are an employee, client or third party named in an incident record and you want to exercise your rights over it, please contact that organisation — they control it, not us. If you approach us directly we will point you to them, and tell them you asked.
3. What we collect
Account and profile
First and last name.
Email address, which is also the sign-in identifier.
A password, stored only as a bcrypt hash with a cost factor of 12. We never store or have sight of the password itself.
Optional profile image reference.
Which sign-in method you use — email and password, or Google.
Your assigned role, and any security appointment such as CISO, ISM or DPO.
Sign-in and security records
Date and time of your last sign-in, and a running count of sign-ins.
The IP address you last signed in from.
Audit entries recording actions taken in the application, each with the acting user, what changed, an IP address and a browser user-agent string.
Organisation records
Organisation name, an email domain, a contact email address, country and time zone.
Subscription plan, seat limit, trial dates and billing status.
Identifiers issued by our payment provider. We never receive or store card numbers — see section 7.
API credentials
If you create a credential for the external API, we show the token once and then keep only a SHA-256 hash of it plus a short non-secret prefix so you can tell your credentials apart. We cannot recover a lost token; you issue a new one.
Website enquiries
Whatever you put in a contact form or email: your name, email address, organisation and message.
What we deliberately do not collect
No advertising or cross-site tracking identifiers.
No behavioural profiling or cross-site tracking.
No analytics at all unless you accept optional cookies; if you do, Google Analytics measures site usage with your IP address anonymised.
No special category data is requested by the product for its own purposes.
Note the limit of that last point: customers can type anything into an incident record, and a security incident may well involve health, criminal-offence or other sensitive information. We do not ask for it and do not use it, but we do store and protect whatever the customer chooses to record. Deciding what is appropriate to put in is the customer’s call as controller.
4. Why we use it, and our legal basis
Purposes and the UK GDPR Article 6 basis we rely on for each. | ||
What we do | Why | Legal basis |
|---|---|---|
Provide the service | Create and authenticate accounts, run the application, store the organisation’s records. | Performance of a contract |
Send service email | Password resets, invitations, incident and action notifications. | Performance of a contract |
Take payment | Subscriptions, add-ons, invoices and renewals. | Performance of a contract |
Keep the platform secure | Audit logging, abuse prevention, investigating faults and suspected misuse. | Legitimate interests |
Support you | Answer enquiries and diagnose problems you report. | Legitimate interests, or contract for existing customers |
Improve the product | Understand which features are used, in aggregate, to decide what to build. | Legitimate interests |
Marketing email | Product news, if you have asked for it. | Consent, withdrawable at any time |
Meet legal duties | Accounting and tax records, responding to lawful requests. | Legal obligation |
Where we rely on legitimate interests, we have considered whether our interest is fair to you and concluded that it is, because the processing is limited to running a service you are using and keeping it safe. You can object — see section 12.
5. Your incident data
Four commitments about customer content:
Each organisation’s records are kept in a separate database. Isolation is structural, not a filter applied to a shared table.
We do not mine it. We do not read, analyse or commercialise incident content. Staff access is limited to what is needed to support you or fix a fault, and such access is logged.
We do not sell it or share it for advertising. Ever, to anyone.
Deletion is recoverable by design. Records are withdrawn from view rather than immediately destroyed, so a mistake can be undone and the audit history stays intact. Evidence files can be permanently destroyed on request through the archive, which removes the underlying file from storage.
6. AI features
The product has three optional AI capabilities: a conversational assistant, AI-generated root cause analysis, and AI processing of uploaded evidence. Here is exactly what happens.
They are opt-in. AI root cause analysis and Evidence AI are paid add-ons switched on by your administrator. Leave them off and no incident content is sent to a model.
Processing stays inside our AWS environment. We use Amazon Bedrock for language models, Amazon Transcribe for audio and Amazon Textract for scanned documents — all called in the Europe (Ireland) region.
Your content is not used to train models. Requests are sent, a result is returned, and the content is not retained by the model provider for training. AWS does not use Bedrock inputs or outputs to train the underlying models.
No decisions are automated. AI drafts text for a person to review, approve or discard. Nothing it produces has a legal effect on anyone, and there is no automated decision-making within the meaning of Article 22.
Usage is metered. We record token and credit consumption per organisation, feature and user so administrators can see usage and we can bill correctly. We keep the counts, not the prompts.
7. Who we share it with
We use a small number of service providers, listed in full with their purpose and location on the sub-processors page. In summary:
Amazon Web Services — hosting, databases, file storage, outbound email and the AI services above.
Stripe — payment processing. Card details go directly to Stripe and never reach our servers. Stripe is a controller in its own right for the payment data it holds.
Google — only if you choose “Sign in with Google”. Google tells us your name, email address and account identifier so we can match you to an account.
Beyond that, we may disclose data:
To professional advisers under a duty of confidence.
Where we are legally required to, though we will tell the affected customer unless prohibited from doing so.
To a buyer if the business is sold or reorganised, under equivalent protections and with notice to customers.
We do not sell personal data, and we never will.
8. Where it is stored
The application, its databases and uploaded evidence are hosted on Amazon Web Services in the Europe (Ireland) region. Databases are not reachable from the public internet, and application servers run inside a private network with controlled outbound access.
Some providers are based outside the UK and EEA, so limited transfers do occur — Stripe and Google in particular. Where that happens we rely on the UK International Data Transfer Agreement or the Addendum to the EU Standard Contractual Clauses, together with any applicable adequacy decision. The sub-processors page records the mechanism for each provider.
9. How long we keep it
The periods below are proposals, not yet policy. Confirm each one against your accounting duties and customer contracts before publishing, then delete this box.
Proposed retention periods. | |
What | Kept for |
|---|---|
Customer content | For as long as the subscription is active. On closure, deleted within 90 days, unless you ask for it sooner or we must keep it by law. |
Account records | Life of the account, then 90 days after closure. |
Audit and security logs | 6 months — long enough to investigate an incident, no longer than necessary. |
Billing records | Six years after the financial year they relate to, to meet accounting and tax requirements. |
Enquiries | 6 months after the matter is closed. |
Backups | Rolling 14 days, after which deleted data ages out. |
Deleting something in the application withdraws it from view immediately. It then persists in backups until those age out on the cycle above.
10. How we protect it
We sell an information security product, so we hold ourselves to the standard we describe. Measures include:
Encryption in transit using TLS, and encryption at rest for databases and stored files.
Passwords stored only as bcrypt hashes; API tokens only as SHA-256 hashes.
A separate database per customer organisation.
Databases with no public network route; application servers in a private subnet.
Role-based access control, with four product roles plus named security appointments.
Audit logging of significant actions, including the acting user and source IP.
Time-limited access tokens with refresh, and administrator-controlled suspension.
Least-privilege credentials for the external API, with optional IP allowlisting.
No service can promise perfect security. If a breach affects your personal data and is likely to result in a risk to your rights, we will notify the ICO within 72 hours of becoming aware where required, and tell affected customers without undue delay.
11. Cookies and local storage
This website uses only essential cookies by default, and optional analytics cookies only if you accept them. When you first visit, a banner lets you Accept, choose Essential only, or Decline. Essential cookies remember that choice and keep the site working; we set nothing else unless you accept. If you accept, we load Google Analytics, which sets its own cookies to measure how the site is used; your IP address is anonymised. Choosing Essential only or Decline means no analytics cookies are set and Google Analytics is never loaded. It also loads a web font from Google Fonts, which means your browser contacts Google to fetch it.
The only cookie this website itself sets is is247_consent, which stores your banner choice for about six months. You can change your choice at any time by clearing it in your browser.
The application itself also avoids cookies. To keep you signed in and remember your preferences it uses your browser’s own storage:
Browser storage used by the application. | ||
Item | Where | Purpose |
|---|---|---|
| Local storage | Authenticates your session. Short-lived. |
| Local storage | Obtains a new access token so you are not signed out constantly. |
| Local storage | Remembers your light or dark theme choice. |
| Session storage | Guards the Google sign-in exchange. Cleared when you sign out. |
All four are strictly necessary to provide a service you have asked for. Signing out clears the tokens; clearing site data in your browser removes the rest.
12. Your rights
Under UK GDPR you can ask us to:
Give you access to the personal data we hold about you.
Correct it if it is wrong or incomplete.
Erase it, where we have no overriding reason to keep it.
Restrict how we use it while a concern is resolved.
Port it to you or another provider in a machine-readable form.
Stop processing based on legitimate interests, by objecting.
Withdraw consent at any time, where consent is the basis.
Email info@infosec247.co.uk. We reply within one month, and will say so if a complex request needs longer. We may need to verify your identity first. Exercising these rights is free.
One important limit. If your request concerns customer content — an incident record naming you, held by an organisation using InfoSec247 — that organisation is the controller and must decide. We will forward your request to them and support them in answering it, but we cannot alter or delete their records on our own initiative.
Users can also do a good deal directly: view and edit your profile, change your password, export incident data as CSV, generate PDF reports, and read everything through the API.
13. Children
InfoSec247 is a workplace tool sold to organisations. It is not intended for anyone under 16 and we do not knowingly create accounts for children. If you believe a child’s data has reached us, tell us and we will remove it.
14. Changes
We will update this notice as the product changes. The version number and date at the top always reflect the current text. For any change that materially affects how we handle your personal data, we will email account administrators at least 7 days before it takes effect, rather than quietly editing the page.
15. Complaints
Please raise it with us first — info@infosec247.co.uk — and we will try to put it right.
You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection, at any time:
Website
Helpline
0303 123 1113
Post
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
If you are in the EEA, you may instead complain to your local supervisory authority.
Related: Terms of service · Sub-processors · Contact us