Privacy Policy

At AESON Solutions, your privacy is important to us. This privacy policy describes AESON Solutions' policy and privacy practices in relation to information collected from users of the TENET platform. It contains AESON Solutions' policy pertaining to the collection, use of, and disclosure of all personal information and governs your access to TENET.

Information Collection Policy

Upon first login, you will be asked to submit some personal information. The personal information that AESON Solutions collects includes your name and email address used to identify you as a user of the Service. Further information provided directly to TENET includes the 'Tenants' belonging to or managed by the user's organization and email addresses for users invited to access TENET, which are entered into the platform for assessment and invitation workflow. All personal information relating to payment card and banking information is handled by our third-party provider 'Stripe' and is not stored by AESON Solutions. Any personal information provided to Stripe through AESON Solutions will be subject to Stripe's privacy policies and terms of use which are available on the Stripe websites. AESON Solutions may also collect other information that does not reveal specific individual identity, such as browser or device type, information collected through cookies and other technologies that are used to facilitate the operation of TENET and for other business purposes. AESON Solutions may also identify and log automatically in our servers, or in third-party log files, the time of a visit to our platform and the page(s) visited. Through normal use of TENET, assessment data is collected and reports can be generated which contain information related to your or client organization's infrastructure. All data collected as part of the tenant assessment will be stored by AESON Solutions for the sole purpose of making the data available to you in TENET. We do not sell, rent, or disclose this information to independent third parties for their own purposes; authorized subprocessors may process it solely to provide the Service.

Self-Service Assessment

If you use our free Cloud Security Self-Service Assessment, you will be asked to sign in with a Microsoft administrator account and authorize AESON Solutions to create an Entra application registration and service principal with the read-only permissions presented during Microsoft's authorization flow. The assessment does not install an agent or modify your workloads. The data collected through this read-only access includes configuration, security, and telemetry information about your Azure and Microsoft 365 tenant, which may include personal data relating to your organization's own users, such as administrator and user account identifiers and role or permission assignments ("Tenant Data"). AESON Solutions processes this Tenant Data as a processor on behalf of your organization, in accordance with our Data Processing Agreement, available at https://aesonsolutions.com/data-processing-agreement.

During the assessment, this data is transferred to a dedicated, isolated environment used exclusively for managing Self-Service Assessments, where it goes through a controlled workflow consisting of data extraction and clean-up, enrichment, analysis, and encrypted transfer back to that environment, in order to generate your assessment reports. We do not sell, rent, or disclose Tenant Data to independent third parties for their own purposes; authorized subprocessors may process it solely to provide the Service.

On completion of the assessment, AESON Solutions automatically creates a 14-day Free Trial Plan account using the name and email address associated with the Microsoft account used to grant authorization, so that your reports and results are available to you in the TENET Portal. That trial account, and any personal information associated with it, is then handled in accordance with the rest of this Privacy Policy.

How AESON Solutions Uses Personal Information

Any personal information AESON Solutions collects from you may be used to:

• Deliver TENET Platform services to you, including free trials
• Contact you to deliver information relating to your use of TENET
• Contact you to deliver product announcements or notifications to TENET
• To monitor, analyse, and improve the performance, stability, and usability of the Service (using anonymized telemetry)
• Administer technical support
• Verify that users have the authorization required to use TENET
• Ask for feedback about your experience with the Service

Transfer of Personal Information

AESON Solutions may use certain trusted third-party companies and individuals to help us improve TENET (including, but not limited to, cloud infrastructure, marketing and payment processing). These third parties may be situated in countries outside of the EEA and will have access to your personal information only for the purpose of performing these tasks on AESON Solutions' behalf and under obligations equivalent to those in this Privacy Policy. As of the effective date of this privacy policy, TENET is hosted on Microsoft Azure in the Northern Europe region (Ireland). You can find more information on Microsoft Azure security at https://www.microsoft.com/en-us/trust-center.

Where personal information is transferred outside the EEA, United Kingdom, or Switzerland, we use an adequacy decision or appropriate safeguards, such as the European Commission's Standard Contractual Clauses, as required by applicable data protection law. The safeguards for Tenant Data are further described in our Data Processing Agreement. You may request more information by contacting privacy@aesonsolutions.com.

Legal Basis For Processing (EEA/UK Users)

Where the GDPR or UK GDPR applies, AESON Solutions processes Tenant Data as a processor on the documented instructions of the Customer, which is responsible for determining the lawful basis for that processing. Microsoft's authorization flow gives AESON Solutions permission to access the Target Tenant; it is not used as the GDPR legal basis for processing the personal data of the Customer's users. For personal information that AESON Solutions processes as controller, we rely on performance of a contract or steps taken at your request before entering into a contract, and on legitimate interests to operate, secure, and improve TENET and the Self-Service Assessment, respond to enquiries, and generate aggregated usage insights, where those interests are not overridden by your rights. We rely on consent for optional marketing communications where consent is required; you may withdraw it at any time by contacting privacy@aesonsolutions.com, without affecting the lawfulness of processing carried out before withdrawal.

Information Excluding Personally Identifiable Information

AESON Solutions may disclose, and make public, aggregated, non-private, anonymized or otherwise non-personal information, such as usage statistics related to TENET, without your consent.

Changing or Deleting Your Information

If you prefer not to receive promotional materials, our email newsletters, or other forms of communication, you may choose to opt-out by unsubscribing from our mailing lists. This can be done by clicking the 'Unsubscribe' link at the bottom of any marketing email. If you wish to remove your organisations' data, please click the 'Delete' button in the 'Management' section of the TENET portal and contact privacy@aesonsolutions.com to request removal of personal data from our systems. AESON Solutions will not sell, rent, or disclose personally identifiable information collected on the platform to independent third parties for their own purposes.

Data Retention

AESON Solutions will retain your personal information for as long as your account is active or as long as it is needed in order to provide TENET's services to you. AESON Solutions may also retain and use your personal information if its use is necessary in complying with AESON Solutions' legal obligations or in enforcing agreements.

If a Self-Service Assessment does not convert to a paid plan, we remove the assessment tenant record and stored connection credential within 21 days of the assessment. The Entra application registration and service principal remain in the Customer's tenant and must be removed by the Customer through Microsoft Entra. Personal information and associated tenant data are permanently deleted 90 days after the Free Trial Plan subscription is cancelled, unless the account is reactivated, earlier deletion is requested, or retention is required by law.

Your Privacy Rights

Subject to applicable law, you may request access to, correction of, deletion of, or restriction of processing of your personal information, object to certain processing, and receive a portable copy of information you have provided to us. To make a request, contact privacy@aesonsolutions.com. You may also lodge a complaint with the data protection supervisory authority in your habitual residence, place of work, or place of the alleged infringement.

Security

AESON Solutions takes security very seriously. Our security practices include technical and organizational measures which endeavour to ensure that the personal information we store is not misused, lost or unlawfully accessed. You can visit our trust center to learn more at https://aesonsolutions.com/trust-center.

Use of Cookies

Cookies are small data files that are placed on your computer or mobile device when you visit a website. Cookies are widely used by website owners in order to make their websites work, or to work more efficiently, as well as to provide reporting information. When you access our websites, we may place a number of cookie files in your web browser. We use strictly necessary cookies for the following purposes: to enable core functions of the TENET platform and to store your preferences. If you want to restrict or block the cookies that are set by our websites, you can do so through your browser settings. Alternatively, you can visit https://www.internetcookies.com, which contains comprehensive information on how to do this on a wide variety of browsers and devices. You will also find additional information about cookies and details on how to delete cookies from your device.