How PrismX handles personal data.

What we collect

• Your account: your work email, your name if you give it, your password (stored only as a secure hash), and when you signed in.
• Your organisation’s risk information: answers, controls, suppliers, systems, data holdings and key people. Key people are names, job titles and contact details your organisation enters.
• Files you upload as evidence, and the submissions you sign. A signature records your name, email, the time, your IP address and your browser.
• Basic technical records that keep the service secure, such as sign-in times and errors.

Why we use it

We do not sell personal data and we do not use it for advertising.

• To provide PrismX: your workspace, your submission and the people your organisation works with in it.
• To keep the service secure and to fix problems.
• To send the emails the service needs, such as your sign-up code.
• To report on the pilot to the insurer running it, using counts and progress, not your files.

Who can see it

• People in your own organisation, by the role your administrator gives them.
• Your insurer’s staff, once you send them a submission or choose to share your progress.
• Your broker, if your organisation works with one in PrismX.
• A PrismX advisor, only if one is assigned to help your organisation.
• CyberPrismx staff, to support you and run the service.

Where it is kept

Your data is held in the European Union. The database runs on Supabase in Frankfurt, Germany. Evidence files and submission packs are stored in Cloudflare R2 with EU jurisdiction.

Services we use

• Supabase, for the database and sign-in (Frankfurt, Germany).
• Cloudflare, to run the app and store files.
• Anthropic, for AI drafts. Only the text a draft needs is sent, never your files, and every draft is reviewed by a person.
• Zoho, to send the service’s emails.

How long we keep it

We keep your information for as long as your organisation uses PrismX and the pilot runs. When an account is closed, we delete or anonymise its personal data unless the law requires us to keep it longer. A signed submission that has been sent to an insurer is also held by that insurer under its own policy.

Your rights

Depending on where you are, you can ask to see the personal data we hold about you, correct it, delete it, limit or object to how we use it, or receive a copy. You can also complain to your data protection authority.

To use any of these rights, email [email protected]. We reply within one month.

Security

Each organisation’s data is kept apart by the database itself, and each role sees only what it needs. Connections are encrypted. Signed submissions carry a fingerprint (a sha256 hash), so any later change can be detected. The Security page explains more.

Changes and contact

We may update this policy. When we do, we change the date at the top and tell you about important changes.

Questions about privacy: [email protected].