Last updated June 14, 2026

Privacy Policy

This policy explains what information Medusyx collects, why, how we protect it, and the choices and rights you have. It applies to medusyx.com and every Medusyx product (the “Services”).

Who we are

Medusyx provides a suite of cybersecurity and threat-intelligence applications and the ATLAS hub. For the personal data processed about your account and users, Medusyx is the data controller; for the security data you connect to the Services, you are the controller and Medusyx is your processor.

Information we collect

We collect only what we need to run the Services:

• Account & identity — name, work email, organization, and role. Passwords are always securely hashed — never stored in plain text.
• Authentication — when you sign in with Google, Microsoft, Apple or GitHub, we receive a verified email and a provider identifier to link your account. We do not receive your provider password.
• Billing — handled by our payment processor. We receive subscription and invoice metadata; we never see or store full payment-card numbers.
• Product & audit telemetry — sign-ins, feature usage and privileged actions are logged for security and reliability.
• Your security data — the assets, findings, intelligence and configuration you connect to each app. This is yours; we process it only to provide the Service to you.

How we use information

To provide, secure, support and improve the Services; to process billing; to communicate service and account notices; and to meet our legal obligations. That's it — we use your information to run Medusyx for you, nothing more.

We don't share or sell your information

We do not sell, rent, or share your personal information with third parties for their own purposes — ever. We also do not use your security data to train AI models. The only outside parties that ever touch your data are a small set of vetted service providers who process it solely on our behalf, under contract, to run the Service:

• a payment processor — to handle billing (we never see full card numbers);
• an email provider — to send transactional email such as password resets;
• cloud infrastructure and security providers — to host and protect the Service;
• an AI provider — for AI-assisted features, under a contract that forbids training on your data (see our AI Policy);
• the sign-in provider you choose — Google, Microsoft, Apple or GitHub — only when you use it to log in;
• threat-intelligence sources — used by the security products to enrich findings.

The only other time we'd disclose information is if required by law, or to protect the rights, safety and security of Medusyx, our customers and the public.

Retention

We keep account data for as long as your account is active, and for a limited period afterward as needed for legal, accounting and security purposes. You can delete it any time — the in-product Danger Zone lets you export or delete your account data directly.

Your choices

You can access, correct, export or delete your information at any time using the in-product controls (Settings and the Danger Zone), or by emailing [email protected] and we'll take care of it.

Security

We apply strong technical and organizational measures, described on our Security page, including encryption in transit and at rest and strict per-tenant isolation.

Children

The Services are for organizations and are not directed to children. We do not knowingly collect data from anyone under 18.

Changes

We'll update this policy as the Services evolve and revise the date above. Material changes will be communicated through the Services or by email.

Questions? [email protected] · [email protected] · [email protected]