Privacy policy
Who we are
Vigil is a security monitoring service operated by Aethersec LTD (Bulgaria), the controller of the personal data described here. For anything about your data, write to [email protected].
When we scan and monitor a client's own systems, we do so on that client's behalf and under our agreement with them: for that data the client is the controller and we are its processor.
What we collect, and why
| Data | Why | Legal basis |
|---|---|---|
| Website visits: IP address, browser, page requested, time | Keeping the site secure and working | Legitimate interest (security) |
| Forms (become a partner, book a demo, trial request): name, work email, company, website, country, your message | Answering your request | Your request (steps before a contract); your consent to store it |
| Accounts: name, email, role, organization, a hash of your password (never the password), two-step sign-in settings | Providing the service to you | Contract |
| Security records: sign-ins (including IP address), changes you make, use of API keys and of AI-assistant (MCP) access | Protecting your account and our platform; investigating misuse; usage reporting | Legitimate interest (security); contract |
| Security Advisor questions: the text you type into the advisor | Answering you; security review; service quality and usage reporting | Contract; legitimate interest |
| Billing: billing name, address, VAT number, invoices, payment status | Charging for the service; tax law | Contract; legal obligation |
| Your organization's systems: domains, hosts, findings, scan results, alerts, and (if you connect them) Microsoft 365, cloud or internal-network data | The monitoring you asked us to provide | On your organization's behalf (as its processor) |
We do not sell personal data, and we do not use it for advertising.
How long we keep it
| Website access logs | 30 days |
| API and AI-assistant (MCP) usage records | 90 days |
| Records of what your integrations sent (destination and result, never the content) | 90 days |
| Contents of emails we sent you | 90 days (the fact that an email was sent stays longer) |
| Security Advisor questions | 365 days, stored encrypted |
| Resolved security findings | Up to 365 days after they are resolved |
| Account and security (audit) records | While your account exists, and afterwards as long as needed to protect the platform and meet legal obligations |
| Form submissions | As long as needed to handle your request and any relationship that follows; deleted on request |
| Invoices | As long as tax law requires |
Who else processes data for us
We use a small number of providers, each only for what it does for us:
- Cloudflare — delivering the website securely and checking that form submissions come from people (Turnstile).
- Resend — sending our emails.
- Google (Gemini) and OpenAI — the Security Advisor and finding triage. We remove IP addresses, domains, web addresses and email addresses before anything is sent to them.
- Revolut and Stripe — payments.
- Our hosting provider — the servers that run Vigil.
- Tools you choose to connect (for example Slack, Jira, Microsoft 365 or your SIEM) receive what you configure them to receive.
Some of these providers are outside the European Economic Area. Where that is the case, transfers are covered by the European Commission's standard contractual clauses or an adequacy decision.
Cookies
We use only the cookies needed to keep you signed in and to protect sign-in. We do not use analytics, advertising or tracking cookies. The bot check on our forms (Cloudflare Turnstile) is used only to tell people from automated abuse.
How we protect it
Security is what we sell, so we hold ourselves to it: encryption in transit and at rest for secrets and sensitive records (each client's with its own key where it matters), strict separation between the parts of our platform, least-privilege access for our own staff and systems, two-step sign-in, continuous monitoring and intrusion detection, and records of who did what.
Your rights
You can ask for a copy of your data, have it corrected or deleted, restrict or object to how we use it, take it to another provider, and withdraw any consent you gave. Signed-in users can download their own data from their settings. For anything else, write to [email protected] — we answer within one month.
You can also complain to a data protection authority: the one where you live or work, or Bulgaria's Commission for Personal Data Protection.
If your organization is our client and your question is about data from your organization's systems, your organization decides — we will pass your request on to them.
Changes
When this policy changes, we update the date above, and tell our clients by email if the change matters to them.