Privacy Policy

Hosted in the EU (OVHcloud, Gravelines, France). No personal data leaves the EEA as part of running this site or the platform.

Who we are

Shieldome Siege ("Siege", "we", "us") is an authorized penetration testing platform at shieldomesiege.com and app.shieldomesiege.com, built by the team behind Shieldome. This policy covers both: the marketing site you're reading now, and the platform itself once you're a customer. Where we process personal data on your organization's behalf as part of running an engagement (for example, findings that reference someone's email address), we act as a data processor and your organization remains the controller - see our Data Processing Agreement for that relationship specifically.

What we collect

On the marketing site, we collect only what you give us directly:

• Contact form submissions - your name, email address, message, and whether you asked for a demo, sent to us when you write to us through the form on the homepage.
• Basic server logs - IP address and request metadata, kept briefly by our hosting and mail infrastructure to detect abuse and keep the contact form from being used to send spam.

Inside the platform, once your organization is a customer, we hold:

• Account data - the username your admin creates for you, your role, and login activity (last login time, failed attempts) needed to keep accounts secure.
• Engagement and audit data - the scope, findings, and a tamper-evident log of every scan, approval, and exploit confirmation run under your organization's account. This log is intentionally append-only, since its whole purpose is being a trustworthy record you can hand to an auditor.
• Branding and integration settings - if you turn them on, your report logo, company name, and Slack/Discord webhook URLs.

We do not run third-party analytics or advertising trackers on either the marketing site or the platform, and we do not sell or share data with advertisers. The only automated check on the contact form is a hidden honeypot field that catches bots, not visitors.

Site analytics

The marketing site counts pageviews to understand what people read, using a small first-party script we host ourselves - no third-party analytics provider ever sees this data. Each pageview is recorded as an aggregate counter for a page and a day (for example, "42 views of /blog/ on 2026-09-17 from google.com"), not as a row tied to a visitor. We never store an IP address, a precise timestamp, a device fingerprint, or anything else that could identify who made a specific visit - there's no record anywhere that corresponds to one person's session, so there's nothing to re-identify even in principle.

Cookies

The marketing site sets no cookies at all - the pageview counter above doesn't use one either. The platform (app.shieldomesiege.com) sets exactly one: a session cookie that keeps you logged in. It's strictly necessary for the platform to function, marked HttpOnly and Secure, and isn't used for tracking or advertising - which is why, under GDPR/ePrivacy rules, it doesn't require a consent banner. We're telling you about it here instead.

How we use it

Marketing site data is used to reply to your inquiry and, if it goes anywhere, to scope and set up an engagement. Platform data is used to run the engagement itself: enforcing scope, recording what happened, generating your reports, and keeping your account secure. We don't use either for advertising.

Legal basis (GDPR)

Contact form data is processed under legitimate interest - responding to an inquiry you initiated - or, once an engagement is being discussed, in preparation for a contract. Platform data is processed to perform the contract your organization has with us (the engagement itself), and to meet our security and record-keeping obligations under that contract.

Who we share it with

We rely on a short list of processors, and don't use anyone else:

• OVHcloud - hosts the marketing site and the platform, in Gravelines, France.
• Titan - relays contact form emails to our inbox.

Neither processor sees your data for any purpose beyond delivering or hosting it. We don't use third-party marketing, analytics, or ad platforms anywhere.

How long we keep it

Contact form correspondence is kept as long as it's relevant to a business relationship or potential one, and deleted on request otherwise. Platform account data is kept for the life of your organization's subscription plus a reasonable period after cancellation, in case you resume service. Engagement and audit-log data is kept for as long as your organization needs it as evidence of the work performed, and deleted on written request once it's no longer needed for that purpose or for a legal obligation we're subject to.

Data breaches

If a breach affecting your personal data occurs, we'll notify affected organizations without undue delay after we become aware of it, so you can meet your own notification obligations where they apply.

Your rights

Depending on where you're located, you may have the right to access, correct, delete, or export the data we hold about you, and to object to or restrict how we use it. To exercise any of these, email [email protected]; if the data was submitted by your organization's admin rather than you directly, we may need to route the request through them. If you're in the EU/EEA, you also have the right to lodge a complaint with your local data protection authority.

Children

This site isn't directed at children, and we don't knowingly collect data from anyone under 16.

Changes to this policy

If we change how we handle data, we'll update this page and change the date at the top. We won't quietly narrow your rights by editing this page after the fact.

Contact

Questions about this policy or your data: [email protected]. For a signed Data Processing Agreement, see our DPA.