Privacy Statement
We believe in full transparency about how we collect, use, and protect your data.
Who We Are
The Secuno platform is operated by Inza ICT B.V., trading as Secuno, a company registered in the Netherlands. As the operator of this platform, Inza ICT B.V. is subject to the General Data Protection Regulation (GDPR) and is registered with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (AP).
Depending on the category of data, Secuno acts in different GDPR roles:
- Data Controller for user account data (name, email, login details): Secuno determines how that data is used.
- Data Processor for endpoint telemetry your organisation collects from its managed devices: your organisation is the Controller and instructs Secuno how to handle that data.
For your user account (name, email, login details), Secuno acts as the Data Controller. We determine how that data is used. For the endpoint telemetry your organisation collects from its managed devices, Secuno acts as a Data Processor. Your organisation is the Controller and instructs us how to handle that data.
What Data We Collect
2.1 Account & User Data
When you register for or use the Secuno platform, we collect the following personal data:
- Required: First name, last name, email address
- Optional: Work phone number, private phone number, job title
- Authentication credentials: Hashed password, 2FA TOTP credentials (encrypted at rest), session tokens
- Activity data: Login timestamps, access logs
Secuno does not collect date of birth, payment card details, national identification numbers, or any data falling under Article 9 GDPR special categories of sensitive personal data.
2.2 Endpoint Security Telemetry
The Secuno agent installed on managed devices collects security-relevant configuration state. The categories and examples below describe what is collected:
| Category | Examples |
|---|---|
| Device identity | Hostname, IP (public + private), MAC address, hardware serial, OS version |
| Security configuration | AV status, BitLocker state, firewall profile, KB patches, Defender sub-protection states (real-time protection, behaviour monitoring, IOAV, script scan, archive scan, cloud protection, network IPS), tamper protection, GPO security policy overrides |
| Defender scan recency | Quick/full scan ages, last scan timestamps, signature age and last update |
| Defender threat detections | Threat events (detection names, timestamps, detection states) |
| Installed software | App names, versions, publishers |
| Network configuration | Network adapter details, open ports (TCP/UDP) |
| Browser extensions | Extension names, versions, IDs (Chrome, Edge, Firefox, other Chromium-based browsers) |
| Local accounts | Local user account names and group memberships (names only, no passwords) |
| Change events | Before/after snapshots when device configuration changes are detected |
| Running processes | Process names, PIDs, parent process, thread counts, and the account under which a process started. For processes the agent flags as suspicious, we also collect the program's file path, its command line (truncated), its code-signing status, and its SHA-256 fingerprint and size. Where behavioural analysis is enabled for your organisation, every process start is recorded rather than only those flagged as suspicious, because a picture of what is normal cannot be built from a record of exceptions. Command lines, code-signing status and file fingerprints stay limited to flagged processes either way |
| Program fingerprints | The SHA-256 hash and byte size of executable files the agent examines. A hash is a one-way fingerprint of the file used to recognise the same program across devices; it cannot be reversed to recover the file or its contents |
| File & script activity | Paths of newly created executable and script files appearing in user-writable locations, and the text of PowerShell script blocks matching known attack patterns (truncated) |
| Network activity | Outbound connections classified as suspicious (remote address, port, and the process that opened them), and DNS lookups flagged as anomalous. Where behavioural analysis is enabled for your organisation, outbound connections and DNS lookups are recorded in full rather than only when flagged, for the same reason |
| Activity timing | Counts of security-relevant events, grouped into eight coarse periods: weekday and weekend, each split into night, morning, afternoon and evening. Used to recognise activity at times a device is otherwise never used. Recorded per device, not per person, and never used for attendance, productivity or working-time measurement |
| Behavioural profile | A per-device summary derived from the telemetry above: which programs have started which other programs, which domains and ports have been contacted, which accounts have used the device, and when it is normally active. Held as a summary rather than as raw events, and used only to detect activity that has never occurred on that device before |
| Per-account behaviour | On devices used by more than three accounts, the profile above is additionally kept per account, so that activity normal for one person is not treated as normal for everyone. Account identifiers are pseudonymised inside the profile, and the association is held separately |
| Sign-in & account activity | Currently logged-on account names, account lockouts, privileged group changes, scheduled task and service creation, and authentication events from the Windows Security log |
We do not collect the contents of your documents, emails, photos, chat messages, or any other personal communications, and we do not collect browser history, keystrokes, or screenshots. The agent reads security-relevant state, not your work.
There are two deliberate exceptions to “no file content”, both narrow and both necessary to detect attacks that leave nothing else behind:
- Script text. Where a PowerShell script block matches a known attack pattern, its text is captured (truncated). An attack that runs entirely in memory leaves no file to examine, so the script itself is the only evidence there is.
- Command lines. The command line of a process the agent flags as suspicious is captured (truncated), because what a program was told to do is often the only thing distinguishing an administrative tool from the same tool in an attacker's hands.
Neither is used for anything other than detecting and investigating attacks on your own devices, and neither is ever included in the cross-customer signatures described in section 7.
2.4 Website Visitors, Enquiries & Newsletter
This applies to visitors of secuno.nl, not to platform users.
- Visit statistics (no cookies): the page you view, the website you came from (domain only), campaign tags in the link (utm parameters), browser, operating system, device type and screen size, time spent on the page, how far you scrolled, whether you interacted with the page, how quickly the page loaded and responded, the name of the network you visit from (your internet provider, or your employer when it runs its own network), and an approximate location (country, region, city) derived from your IP address. Your IP address itself is never stored. See section 8.
- Visit source (stored in your browser): the date and page of your first visit and of your latest visit that came from another website or a tagged link, with that website's domain and the link's campaign tags. It contains no identifier and is only sent to us as part of a form you submit, so we can see what brought you to us. See section 8.
- Demo and contact requests: name, email address, company (optional) and your message.
- Partner applications: company name, your name, email address, website (optional), the number of clients and endpoints you manage, and your message (optional).
- Microsoft 365 security check: your answers to the ten questions, the resulting score, your email address and, optionally, your name and company. The answers describe how your Microsoft 365 is configured; we never connect to your tenant.
- Patch this first newsletter: your email address, preferred language, the page you signed up on, the version of the consent text you agreed to, and the dates you subscribed, confirmed and unsubscribed.
With every form and newsletter signup we also record which page you first landed on that day and where you came from, so we can see which content leads to a conversation. This uses the same visit statistics described above and no additional tracking.
Why We Process Your Data
We process personal data only for specific, documented purposes. The table below sets out each purpose, the lawful basis under the GDPR, and the data involved.
| Purpose | Legal Basis | Data Involved |
|---|---|---|
| Providing the Secuno platform | Contract (Art. 6(1)(b)) | Account data, endpoint telemetry |
| Authentication & access control | Contract (Art. 6(1)(b)) | Email, hashed password, session tokens, 2FA data |
| Security monitoring & audit logging | Legitimate Interest (Art. 6(1)(f)) | Login timestamps, access logs, device change events |
| CVE vulnerability correlation | Contract (Art. 6(1)(b)) | Installed software names & versions |
| Behavioural anomaly detection | Legitimate Interest (Art. 6(1)(f)) | Endpoint telemetry, per-device behavioural profile |
| Website visit statistics (secuno.nl) | Legitimate Interest (Art. 6(1)(f)) | Pages viewed, referring domain, approximate location, browser and device type, a daily rotating visitor hash |
| Answering demo, contact and partner requests | Pre-contractual steps at your request (Art. 6(1)(b)) | Name, email, company, message, partner details |
| Sending your Microsoft 365 check report | At your request (Art. 6(1)(b)) | Email address, answers, score |
| Patch this first newsletter | Consent (Art. 6(1)(a)), confirmed by email (double opt-in) | Email address, language, consent record |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) | Audit logs, account records |
We do not use your data for advertising, or for any purpose beyond what is listed above. We do not sell your data. You can withdraw your newsletter consent at any time with the unsubscribe link in every issue; this takes effect immediately.
Where behavioural analysis is enabled for your organisation, Secuno builds a profile of each device (what is normal for that machine) so that it can detect attacks no signature recognises. It is never used to assess, rank, score or monitor the people who use that device, it produces no automated decision that has legal or similarly significant effects on anyone, and it is not used for attendance, productivity or working-time measurement. Where a device is shared by several people, the account identifiers inside the profile are pseudonymised. Your organisation decides whether this is enabled, and can turn it off.
Where Your Data Is Stored
Secuno is a locally hosted platform. Your data never leaves the European Union and is not transferred to third countries.
Key infrastructure facts:
- Location: Netherlands (EU/EEA)
- Hosting model: Locally hosted, with no data residency risk and no third-country transfers
- Multi-tenancy: Every organisation's data is logically isolated; all records are scoped to the organisation's unique identifier
- Backups: Stored within the same Netherlands infrastructure
- Website statistics, enquiries and newsletter subscriptions: stored in a separate database on a Secuno-operated server in the Netherlands, apart from the platform. The public website can only add records to it and cannot read them back.
Because all processing takes place within the Netherlands and the EU, no Standard Contractual Clauses or other transfer mechanisms are required.
How We Secure Your Data
Encryption
| What | How It Is Protected |
|---|---|
| Passwords | Hashed with a salted one-way algorithm; never stored in plain text |
| Two-factor authentication secrets | TOTP seeds stored encrypted at rest |
| All data in transit | TLS 1.3 enforced; HSTS enabled; unencrypted HTTP rejected |
| Agent communications | Every agent request signed using Ed25519 key pairs + SHA3-256 body hash |
| Device private keys | Never leave the endpoint. Protected by Windows DPAPI; only the public key is stored in Secuno |
| Session tokens | Short-lived access tokens (15-min expiry), rotating refresh tokens (8-hour expiry) |
Access controls
- RBAC: users only see data their role permits
- Mandatory 2FA available for all accounts
- All admin actions recorded in a tamper-evident audit log
- Organisation data isolated at the database level
Operational security
- No access to customer environments without explicit logged authorisation
- Regular security reviews
- Incident response procedures
- The agent's local data directory is hardened with Windows ACLs (SYSTEM and Administrators only; standard users explicitly denied)
- All AI enrichment runs on a locally hosted model. No data is sent to external AI or cloud LLMs
How Long We Retain Data
| Data Type | Retention Period | Notes |
|---|---|---|
| User account data | Duration of account + 30 days after deletion | Deleted on request or account closure |
| Device telemetry | Duration of device enrolment | Removed when device is decommissioned or contract ends |
| Behavioural profile | Duration of device enrolment | A rolling summary of the retention window your organisation has set (90 days by default). Deleted with the device |
| Behavioural anomaly records | 1 year | Each record keeps the evidence it was raised on, so it stays reviewable after the profile it was compared against has moved on |
| Audit logs | Duration of subscription | Available for export before contract end |
| Security session tokens | Access: 15 min · Refresh: 8 hours | Automatically expired; not stored after expiry |
| Session activity state | Inactivity timeout window (default 30 min) | Deleted immediately on logout or when timeout elapses |
| Risk acceptance records | Indefinite (as part of risk record) | Deleted when risk or org account deleted; cleared when acceptance expires and risk reopened |
| Website visit statistics | 90 days | After that only daily totals remain (visitors per day and per country), kept for 25 months. The salt behind the visitor hash is deleted every day |
| Demo, contact and partner requests, Microsoft 365 check results | 24 months | Deleted earlier on request. Submissions marked as spam are deleted after 30 days. If you become a customer, the relationship continues under your contract |
| Newsletter subscription | Until you unsubscribe, then 30 days | Signups that are never confirmed are deleted after 30 days |
| Emails we send (copies in our send queue) | 30 days | Kept only to retry delivery and diagnose failures |
| Contract & billing records | 7 years | Required by Dutch accounting law (Burgerlijk Wetboek) |
On contract termination, all your organisation's data is deleted from primary systems within 30 days and from backups within 90 days, unless you request earlier deletion or legal obligations require retention.
Sharing & Third Parties
We do not share your personal data with advertisers, data brokers, or any other commercial third parties.
We may share data only in the following limited circumstances:
- Within your organisation: Authorised Secuno users within your organisation can access the data associated with their role.
- Cross-customer threat intelligence: Structural descriptions of how attacks behave, which do not identify your organisation or contain its data. This is explained in full below.
- Legal obligations: Where required by Dutch or EU law, court order, or supervisory authority request. We will notify you where legally permitted to do so.
- Successor organisations: In the event of a merger or acquisition, data will be transferred only with the same or stronger privacy protections and with advance notice to users.
Cross-customer threat intelligence
Secuno's detection engine learns from attacks across its entire customer base. When an attack is identified on one organisation's device, the engine extracts a structural signature, a description of how the attack behaved, and matches that signature against every other organisation we protect. An attack seen once anywhere becomes a defence everywhere, which is how a customer can be protected against an attack that has not yet reached them.
A signature deliberately describes how an attack behaved, never where it happened. It contains only the following:
| What a signature contains | Explanation |
|---|---|
| Attacker infrastructure | Public IP addresses and domain names the attack contacted. Addresses on your internal network (private, loopback and link-local ranges) are excluded automatically. |
| File fingerprints | The SHA-256 hash of files that have already been identified as malicious. A hash is a one-way fingerprint: it cannot be reversed to recover the file, its contents, or its name. |
| Attack techniques | Standard MITRE ATT&CK technique codes and the categories of signal observed (for example “credential abuse”). |
| Behavioural patterns | Pairs of program names describing what launched what, for example a document reader starting a script interpreter. Reduced to the bare program name, without the folder it ran from. |
| Coarse timing | The hour of day, and whether it was a weekday or a weekend. |
Device names, user accounts, file paths, command lines, documents, software inventory, your internal IP addresses, per-device behavioural profiles, and the identity of the organisation where an attack was first seen are all excluded from a signature. This exclusion is applied by the software at the moment a signature is created. It is a property of how the system is built, not a policy someone has to remember to follow.
Where the engine acts on this intelligence, for example by instructing agents to block a malicious IP address or domain seen attacking another customer, what is distributed is the attacker's infrastructure, never any information about the organisation that encountered it. Where a report tells you that an attack was previously seen elsewhere, it says only that it was seen “on another organisation in the fleet”, without naming it.
All other analysis stays inside your own account. Correlating activity across your devices (establishing what is normal for your fleet, spotting a program that has appeared on only one machine, building the timeline of an incident) is performed strictly within your own organisation's data, and is never computed across customers.
File prevalence (optional, disabled by default)
Secuno can tell you how widely a particular file is found across all protected organisations. Knowing that a program is present on thousands of devices, or on almost none, is one of the strongest available signals for telling ordinary software apart from an intruder's tool.
This feature is switched off unless your deployment explicitly enables it. When it is enabled, three limits apply:
- You can only ask about a file that is already present on your own devices. It is not possible to look up an arbitrary file to discover whether another organisation has it.
- The answer about other organisations is a banded range (“uncommon”, “25–249 devices”), never an exact figure, and never any indication of which organisations those are.
- Where fewer than five devices outside your own organisation hold a file, no number or range is given at all: only the word “rare”.
Counts of your own devices are always exact, because that is your own data.
Website analytics and email delivery
secuno.nl uses no third-party analytics, advertising pixels or tracking scripts. Statistics are collected and stored by Secuno itself. Approximate location is looked up in a database file (DB-IP Lite) that is downloaded to our own server, so your IP address is never sent to anyone for this.
Emails we send (newsletter confirmations, the newsletter itself, Microsoft 365 check reports and internal notifications to our sales team) are delivered through an email delivery provider acting as our processor under a data processing agreement. It receives only what is needed to deliver each email.
CVE intelligence feeds
CVE correlation processing runs entirely within Secuno's infrastructure. Software names and version data are not sent to any external services. CVE data is pulled in to Secuno, not pushed out.
EPSS exploit probability scores (FIRST.org)
Secuno performs a daily fetch of EPSS exploit probability scores from the FIRST.org API. Only CVE identifiers (e.g. CVE-2024-12345) are transmitted in this request. No personal data, software inventory, device information, or organisation-specific data is included. FIRST.org is a non-profit organisation; their privacy policy is available at first.org.
Cookies & Analytics
Marketing website (secuno.nl)
secuno.nl sets no analytics or tracking cookies. It keeps two small items in your browser's local storage: your choice in the cookie notice, and the visit source described in section 2.4. The visit source holds no identifier, is never sent with page visits, and only reaches us inside a form you choose to submit. You can remove it at any time by clearing your browser data for secuno.nl.
To count visits without cookies, our server combines your IP address and browser identifier with a random value that is replaced every day, and keeps only the resulting one-way code. That lets us count unique visitors per day; because the random value is deleted daily, the code cannot be linked to you or to your visits on other days. Your IP address is used for that calculation and to look up an approximate location, and is then discarded. Locations are stored at city level, with coordinates rounded to roughly 10 km.
We also check each visit for signs of automated traffic (for example crawlers, headless browsers and data-centre networks) so that bots do not distort the statistics. Visits identified as automated are discarded or only counted.
We also receive aggregated search statistics from Google Search Console and Bing Webmaster Tools: which search terms showed secuno.nl and how often it was clicked. These are totals per search term and page, with no information about individual visitors.
| Storage | Purpose | Duration |
|---|---|---|
| secuno-cookie-consent (local storage) | Remembers that you closed the cookie notice | Until you clear your browser data |
| sx_src (local storage) | Date, landing page, referring domain and campaign tags of your first visit and latest sourced visit; sent only with a form you submit | 90 days from your first visit |
Secuno platform (app.secuno.nl)
The platform uses only strictly necessary cookies for authentication and session management. No tracking or marketing cookies are used. All cookies are session-scoped.
| Cookie | Purpose | Duration |
|---|---|---|
| Authentication session | Keeps you logged in during your session | Session (max 8 hours) |
| CSRF token | Protects against cross-site request forgery attacks | Session |
Your Rights (GDPR)
As a data subject under the GDPR, you have the following rights. Exercise any of them by contacting us using the details in Section 10.
Request a copy of all personal data we hold about you
Ask us to correct inaccurate or incomplete personal data
Request deletion of your personal data where no legal basis remains
Ask us to limit how we process your data in certain circumstances
Receive your data in a structured, machine-readable format
Object to processing based on legitimate interests at any time
We do not make solely automated decisions that significantly affect you
Where processing is based on consent, you may withdraw at any time without affecting the lawfulness of prior processing
We will respond within one month of receiving your request. This period may be extended by two further months for complex or numerous requests; we will notify you if this is the case. There is no fee for reasonable requests. For requests relating to endpoint telemetry data, we may redirect you to your organisation's IT administrator as the Data Controller for that data.
Complaints
If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Dutch supervisory authority:
Autoriteit Persoonsgegevens (AP)
Bezuidenhoutseweg 30, 2594 AV Den Haag
autoriteitpersoonsgegevens.nl
Contact & Data Protection
For any questions about this Privacy Statement or to exercise your data subject rights, please contact us:
Company: Inza ICT B.V. (Secuno)
Address: Netherlands
Email: [email protected]
Website: secuno.nl
We aim to respond to all privacy enquiries within 5 business days and to resolve data subject requests within 30 days.
Changes to This Statement
We may update this Privacy Statement from time to time. When we do:
- We will update the “Last updated” date at the top of this statement.
- Significant changes will be notified by email and/or in-platform notification at least 30 days before taking effect.
- Your continued use of the Secuno platform after the effective date constitutes acceptance of the updated statement.
Previous versions are available on request.
This Privacy Statement was last reviewed and updated in October 2026 (version 1.4: visit source in local storage, page speed, network name and search statistics; version 1.3: website statistics, enquiry forms, the Microsoft 365 check and the Patch this first newsletter). It applies to all users of the Secuno platform and visitors to secuno.nl.