Privacy Policy
At EonCyber, defending your data is our mission. Learn how we safeguard your personal and enterprise telemetry information with uncompromising cybersecurity protocols.
Contents
Client vulnerability telemetry and audit data are encrypted using Zero-Knowledge standards.
Contact Data Privacy Officer →1. Introduction & Overview
Welcome to EonCyber ("we", "our", or "us"). As a provider of cybersecurity services (including Security Operations Center (SOC) and Network Operations Center (NOC) monitoring, managed security, vulnerability assessment, incident response and awareness training) and security solutions (Phishing Simulation, Attack Surface Management, Human Risk Management and Helpdesk & Ticketing), we respect your right to privacy and are deeply committed to protecting personal and sensitive organizational data.
This Privacy Policy outlines the types of information we collect, how we handle and protect that data, your legal privacy rights, and how the law protects you. By using our website (eoncyber.in) or engaging our security services, you acknowledge the terms described in this policy.
Our Core Commitment:
We strictly treat all client infrastructure data, vulnerability logs, incident tickets and security assessment findings under strict Non-Disclosure Agreements (NDAs) and never sell or monetize your data.2. Information We Collect
Depending on how you interact with EonCyber, we collect data across several distinct categories:
Direct Contact Details
When you submit contact forms, request security consultations, or apply for careers: name, business email, telephone number, organization name, job title, and project requirements.
Security Telemetry & Scope Data
For engaged clients: target IP ranges, domain lists, system architecture diagrams, vulnerability discovery logs, and diagnostic audit telemetry provided under contract.
Technical Usage Data
Standard request logs recorded by our website hosting provider when you visit: IP address, browser type, device and operating system, pages requested and access timestamps.
Security Solution Data
For clients using our solutions: employee names and work emails for phishing simulations and human risk scoring, internet-facing asset data for attack surface management, and incident and ticket records in our helpdesk.
Incident Forensics Data
When assisting in incident response: network traffic dumps, server event logs, and forensic disk images strictly used for root cause containment.
3. How We Use Your Data
We utilize collected information exclusively for legitimate cybersecurity operations and professional client management:
- Delivering Contracted Security Services: Delivering SOC and NOC monitoring, vulnerability assessments, incident response, awareness training and our security solutions, and preparing the related reports.
- Responding to Inquiries: Providing technical consultations, service proposals, and responding to inquiries submitted via our contact portal.
- Threat Alerting & SOC Incident Handling: Immediate communication of high-severity vulnerabilities or active perimeter breaches to authorized client stakeholders.
- Regulatory Compliance & Defense: Maintaining mandatory compliance audit trails as required by Indian cyber regulations (IT Act / CERT-In) and international security standards.
4. Data in Our Security Solutions
When an organization uses our solutions, it decides what data is provided and EonCyber processes that data on its behalf, only to deliver the contracted solution:
- Phishing Simulation: employee names and work email addresses, and whether simulated emails were opened, clicked or reported.
- Human Risk Management: simulation results, training progress and security behaviour indicators used to calculate risk scores for employees and teams, visible only to the client's authorized administrators.
- Attack Surface Management: publicly reachable information about the client's own domains, IP addresses, services and certificates, discovered only within the scope the client authorizes.
- Helpdesk & Ticketing: incident and request details, requester names and contact details, and the history of actions taken, kept as an audit trail for the client.
Client data from our solutions is never used for marketing and is never shared with other clients.
5. Security & Data Protection Measures
As an elite cybersecurity firm, we hold our internal systems to the strictest defense-in-depth criteria:
AES-256 Encryption
All data in transit (TLS 1.3) and at rest is secured with military-grade encryption.
Zero Trust Access
Strict least-privilege RBAC with mandatory Multi-Factor Authentication (MFA).
Isolated Sandboxes
Client audit logs & vulnerability proofs are kept in segregated environments.
While no transmission method over the internet can be guaranteed 100% impenetrable, EonCyber maintains continuous SOC monitoring and offensive testing against our own infrastructure to prevent unauthorized access.
6. Information Sharing & Third-Party Disclosure
We do NOT sell, rent, trade, or commercialize your personal or technical data to third parties.
We may only disclose relevant information under the following limited and controlled circumstances:
- Authorized Sub-processors: Verified infrastructure partners (such as website hosting, cloud hosting for our solutions and email delivery) bound by confidentiality and data processing agreements.
- Legal & Law Enforcement Mandates: Where required by applicable Indian or international law, court subpoenas, or authorized government agencies (e.g., CERT-In incident notifications).
- Protection of Rights: To enforce service agreements or safeguard the vital security of our clients or the public against malicious cyber attacks.
7. Retention & Secure Purging
We retain personal data and security engagement artifacts only for as long as necessary to fulfill the purposes for which it was gathered:
- Inquiry & Consultation Data: Retained up to 24 months unless earlier deletion is requested.
- Security Assessment & Exploit Proofs: Securely wiped and sanitized within 90 days following final report sign-off and re-testing, unless contractual retention rules specify otherwise.
- Solution Data: Retained for the duration of the client's subscription and deleted or returned on termination, as set out in the client agreement.
- Financial & Tax Records: Retained in accordance with Indian statutory accounting requirements (typically 7 years).
9. Your Rights & Choices
Under relevant data protection frameworks (including India's Digital Personal Data Protection Act and global data privacy standards), you possess the following rights:
To exercise any of these rights, email our team at [email protected].
10. Children's Privacy & Changes to This Policy
Our website and services are intended for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.
We may update this Privacy Policy as our services, solutions or legal requirements change. The "Last Updated" date at the top of this page shows when it was last revised, and material changes will be highlighted on this page.
11. Contact Information & Inquiries
If you have questions, concerns, or requests regarding this Privacy Policy or our security handling practices, please contact our Data Governance & Security Office: