Privacy Policy

Effective: October 15, 2026 (version 2026-10-15.2)

1. Who we are

The CyberArmor platform is operated by HEGEON PRIME SERVICES LTDA, CNPJ 28.297.591/0001-20 ("CyberArmor", "we"). CyberArmor is the brand; the company responsible for the data is HEGEON PRIME SERVICES LTDA. Privacy contact: dpo@cyberarmor.com.br.

The platform is a security service for companies (B2B): inventory and posture of machines and repositories, vulnerability findings, compliance and response. This policy applies to people who use the platform, visit the website, or have data processed through it.

2. The roles we act in

The Brazilian General Data Protection Law (LGPD, Law 13,709/2018) distinguishes whoever decides about the data (controller) from whoever processes it on another party's behalf (processor). We act in both roles, depending on the data.

Customer is the company that signed up. User is the person who accesses on the Customer's behalf.

3. When we are the controller

B2B sales prospecting (professional contact data obtained from third parties)

To offer the platform to companies, CyberArmor researches information security and IT professionals (for example CISOs, directors, managers and data protection officers) at mid-sized Brazilian companies. The data comes from Apollo.io (Apollo.io, Inc., United States), a provider of professional contact data; we do not collect it directly from you.

• What data: name, job title, seniority and department, company (name, domain, industry and size), city, state and country, and, when looked up, professional email, public professional profile (LinkedIn) and business phone. We also record the status of the contact (stage, notes and next action) and where the data came from. We do not collect sensitive personal data or children's data in this activity.
• Purpose: B2B sales contact to present the service to people whose role it is usually relevant to. We do not use this data for any other purpose.
• Legal basis: legitimate interest (LGPD, art. 7, IX). We carried out and recorded a balancing test (legitimate interest assessment) covering purpose, necessity and the impact on you. It concludes that the processing is consistent with your reasonable expectations, because we use only professional contact data, on a subject tied to your role, with few fields and a simple way to opt out. The record is available on request from the DPO.
• Source disclosed: in the first contact we tell you that we obtained your professional data from Apollo.io and how to exercise your rights.
• Opt out in every contact: every commercial message includes a way to ask not to be contacted again. Anyone who does so (or objects through the DPO) stops being contacted and is added to a suppression list that stores only an identifier protected by a keyed hash (not your email in the clear), so the automated search does not bring you back.
• Retention: we keep the contact for up to 24 months with no interaction from you (reply, meeting or proposal). After that the record is deleted or anonymized. Where there is a commercial relationship, the periods in section 11 apply.
• International transfer: Apollo.io is in the United States (section 10).
• Your right to object: you may object to this processing at any time, without giving a reason, by writing to the DPO (section 14). You may also ask for access, correction and deletion (section 12).

What we do not do

We do not sell personal data. We do not use Customer content for advertising or for any purpose other than providing the contracted service.

4. When we are the processor

Customer content is what the Customer puts into the platform or collects through the agents: security findings and evidence, machine and software inventory, agent telemetry, reports, settings, repositories and metadata read through integrations (such as commit author and email), information about the Customer's suppliers and records of the Customer's users' activity on the platform.

We process that content only to provide the service, under the Customer's instructions. The Customer is the controller: it sets the legal basis, informs its employees and other data subjects, and answers their requests. The relationship is set out in the Terms and the Data Processing Agreement (DPA).

Some telemetry and security log data also serves the security of the platform itself (for example, detecting tampering with the agent). For that purpose we act as controller.

What we expect from the Customer: to have a legal basis for the data it sends; to inform the users of monitored machines; not to send sensitive personal data (health, biometrics, racial or ethnic origin, etc.) or children's data; to install the agent only on machines it has authority over.

5. Agents installed on machines

The CyberArmor agent is a program the Customer installs on computers and servers (Windows and Linux). It communicates with the platform over a secure, authenticated connection. The categories below describe the current version and may change with agent versions.

• Machine and agent identification: machine name, operating system and version, agent version, uptime, local IP address, signed-in user, agent integrity status.
• Hardware: processor, cores, memory, disk size and free space, main IP and MAC address, network interfaces.
• Installed software: name, vendor, version and source.
• Running processes: identifier, name, executable path, owner user, memory and processor use, start time.
• Network connections and ports: protocol, local and remote addresses and ports, state, associated process, listening ports.
• System security events: process creation (name, path, command line), logon and failed logon, service installation, user account creation and deletion, scheduled task creation.
• Security posture: local administrators, startup items, patches, firewall status, disk encryption, detected remote-access tools, removable media, browser extensions, configuration checks against reference rules.
• Network discovery (when enabled by the Customer): devices on the local subnet (IP, name, MAC, common open ports).
• Threat detection: comparison of files and processes with indicators of compromise supplied by the platform; the agent sends the result (process, indicators found, risk score), not memory contents.

The agent is not designed to collect email or message contents, browsing history, passwords, keystrokes, screenshots, clipboard, microphone, camera or document contents. Note: a process command line, a file name or a disk label may contain personal data that the user typed. That is incidental to the processing, and the Customer should take it into account when informing its employees.

The agent also runs commands signed by the platform when the Customer (or a policy it configured) asks, for example installing a patch, starting or stopping a service, or collecting data on demand. It verifies the signature before running. A local administrator can still stop or remove the agent; in that case the platform alerts the Customer.

Agent data goes to the Customer's environment on the platform, separated from other customers. Users authorized by the Customer see it. CyberArmor staff access it only with justification and logging.

6. Sensitive data and children

The platform is for companies only and is not intended for people under 18. We do not ask for sensitive personal data (LGPD, art. 5, II). If the Customer sends it, it does so at its own responsibility, and we will ask for it to be deleted.

7. Where data comes from

Directly from Users; from the agents and integrations the Customer installs and authorizes (including GitHub); from the payment provider (billing status); for sales contact, from the information you send us yourself; and, for B2B prospecting, from Apollo.io, a provider of professional contact data (section 3).

8. Cookies and browser storage

The website does not use advertising or tracking cookies, and nothing that is not necessary runs before you choose in the cookie bar. With your consent (LGPD, art. 7, I), the website measures visits with Vercel Web Analytics, operated by Vercel Inc. (USA): it sets no cookies, counts visits and page views in aggregate, and tells us which content is useful. Also with consent, the website remembers the theme you chose and the dismissal of the language suggestion. Your choice is recorded in your browser, with the date and the version of the Cookie Policy, and you can change it at any time under "Cookie preferences" in the footer. The full list, with the name, purpose, duration and category of each item, for the website and the app, is in the Cookie Policy.

9. Who we share data with

We share data only when needed for the service, under contract and a duty of confidentiality. We do not sell data. Suppliers that process data on our behalf:

The full list of platform processors, with the purpose and location of each, is in the DPA and is given to the Customer at signing; anyone can request it from the data protection officer. We notify the Customer before changes to that list. We may also share data with accounting and legal advisers (under confidentiality), with authorities when law or a court order requires, and with an acquirer of the company in a corporate transaction, with notice.

10. International transfers

Some of the suppliers above may process data outside Brazil, especially in the United States. This is the case of Apollo.io, which is based in the United States and from which we receive professional contact data. We transfer data only with a mechanism provided for in the LGPD (art. 33) and in ANPD Resolution CD/ANPD 19/2024, such as standard contractual clauses or an adequacy decision. You can ask the data protection officer which mechanism each supplier uses.

11. How long we keep data

We keep the minimum necessary for the shortest time possible. When an account is closed:

• Closure request: made by the account owner in the platform, with strong authentication. There is no immediate deletion.
• 30-day grace period: the account is frozen (access, integrations, webhooks and SSO revoked). It can be reactivated, and nothing is deleted.
• Export: before deletion, the Customer can export the full content (JSON or CSV, with integrity verification).
• Deletion: Customer content is deleted from production within 30 days after the grace period.
• Backups: expire within 35 days. If a backup is restored, the deletion is redone.
• Proof: we issue deletion receipts (end of deletion in production and end of the backup cycle), stating what was retained, why and until when.

What we keep afterwards, as controller, separated and with no other use: tax and billing documents for the period required by tax and accounting law (as a rule, 5 years); contract and acceptance for the applicable limitation period; application access records for at least 6 months (Marco Civil da Internet, art. 15); platform security and audit records for as long as needed for security and to prove rights, with no personal data in clear text in the audit record; deletion receipts. When the period ends, we delete. The full retention policy is given to anyone who asks the data protection officer.

Machines with an agent: the Customer must uninstall the agents before closing the account. Machines that are off receive a revocation attestation when they reconnect. Agents left installed become inert.

Contact requests made on the website: we keep the request for up to 24 months without a new interaction from you (reply, meeting or proposal). After that, we delete or anonymize it. We record the request date and the version of this notice you saw.

12. Your rights as a data subject (LGPD, art. 18)

You can ask for: confirmation that we process your data; access; correction; anonymization, blocking or deletion of unnecessary or excessive data; portability; information about sharing; information about the possibility of not consenting and its consequences; withdrawal of consent; objection to processing carried out without consent where the law is not followed (including B2B sales prospecting, which we do on legitimate interest); review of decisions made solely by automated means.

How to ask: write to the data protection officer, dpo@cyberarmor.com.br. We ask for proof of identity. We answer in simplified form immediately, or with a full declaration within 15 days, as the law requires (art. 19).

• Data for which we are the controller (account, billing, platform security, website, sales contact and B2B prospecting): we answer.
• Customer content data (you are an employee or user of a Customer company, or appear in machine, finding or repository data): the Customer company is responsible. We forward your request to the Customer within 5 business days, without answering on the merits, and help the Customer with search, export and deletion. If the Customer is your employer, also contact the responsible department there.

You may also complain to the Brazilian data protection authority (ANPD). We may keep what the law requires us to keep (section 11) or what we need to defend rights, stating the basis.

13. Security and incidents

Measures: data isolation between customers in the database, MFA and re-authentication for sensitive actions, encrypted secrets, chained audit record, centralized credential revocation, signed commands to agents, single-use uninstall tokens, agent tamper detection, minimum and logged access for staff. No system is invulnerable; we do not promise zero risk.

If a security incident may cause relevant risk or harm, we notify the Customer by email, at the registered security contact, without undue delay, with the nature of the incident, the data and data subjects affected, the measures taken and a contact. The Customer, as controller, notifies the ANPD and data subjects when needed; we cooperate. For data for which we are the controller, we notify.

14. Data protection officer (DPO)

Encarregado de dados da Hegeon. Email: dpo@cyberarmor.com.br. The officer receives data subject requests and communications from the ANPD (LGPD, art. 41).

15. Changes to this policy

We may update this policy. Relevant changes are notified by email to account owners and in the app, with reasonable notice. The effective date at the top shows the version in force. Earlier versions are available on request.

16. Governing law and contact

This policy is governed by Brazilian law. Questions: dpo@cyberarmor.com.br.