Privacy Policy & Data Protection Highlights

Thank you for visiting Drosera, including all associated websites, customer portals, subdomains, and service endpoints (collectively, the “Website” or “Platform”). Drosera is a cybersecurity platform owned and operated by ISECURION Technology and Consulting Private Limited (“ISECURION”, “Drosera”, “we”, “our”, or “us”).

At Drosera , we are committed to protecting the privacy, confidentiality, and security of the information entrusted to us by our customers, users, and authorized participants. This Privacy Policy explains how we collect, use, process, disclose, and safeguard Personal Data in connection with our cybersecurity platform and managed services, including phishing simulation, adversary emulation awareness validation, reporting dashboards, and related managed security services (collectively, the “Services”).

These Data Protection Highlights are intended to provide a concise overview of our privacy and data handling practices. For a complete understanding of how we manage information, please review the sections below.

What is Personal Data?

“Personal Data” means any information that identifies, relates to, describes, or can reasonably be linked to an individual, directly or indirectly. This may include information such as your name, official business email address, phone number, organization details, IP address, device information, login activity, and any other information that may be used to identify you or your interactions with our Platform.

Scope of this Policy

This Privacy Policy applies to all information collected through our websites, customer portals, SaaS platform, APIs, integrations, support channels, and managed service engagements. It covers customer administrators, authorized users, campaign participants, and technical telemetry generated as part of authorized cybersecurity validation activities.

Information We Collect

We collect information necessary to provide, secure, and continuously improve our Services. This may include customer and account information such as organization name, administrator details, official business email addresses, billing information, subscription details, tenant identifiers, and role-based access permissions.

In the course of delivering phishing simulation, we may also process operational and simulation-related information such as employee names, corporate email addresses, campaign participation data, click and interaction metrics, simulated credential submission events, endpoint telemetry, callback metadata, validation logs, security awareness results, attack simulation evidence, and risk scoring information.

We may also automatically collect technical information including IP addresses, browser and device metadata, operating system details, access timestamps, authentication logs, SMTP and DNS routing logs, API request records, diagnostic logs, and infrastructure audit trails.

Where customers upload custom content, we may process templates, playbooks, documents, attachments, branding assets, scripts, and configuration artifacts necessary to perform authorized security validation exercises.

How We Use Personal Data

Personal Data collected through the Platform is used solely for legitimate business and cybersecurity purposes. This includes delivering phishing campaigns, generating reports and dashboards, improving platform performance, authenticating users, preventing misuse, and complying with legal, regulatory, and contractual obligations.

Authorized Security Testing

Drosera is intended strictly for authorized cybersecurity testing, awareness validation, red-team simulation, and resilience exercises. Customers are solely responsible for ensuring that all use of the Services, including phishing campaigns is conducted only within systems, networks, applications, and personnel groups for which they have explicit authorization and lawful approval.

Data Sharing and Disclosure

We do not sell, rent, or trade Personal Data. Information may be shared only with trusted cloud and infrastructure providers, secure messaging and email delivery partners, authorized managed service personnel, legal advisors, auditors, and competent authorities where disclosure is required by law or necessary to protect the integrity and security of our Platform and customers.

All third-party providers engaged by us are required to maintain appropriate confidentiality, security, and compliance safeguards.

Data Security and Protection Measures

At Drosera , operated by ISECURION Technology and Consulting Private Limited, we implement enterprise-grade administrative, technical, and organizational safeguards designed to protect information against unauthorized access, disclosure, alteration, or destruction.

Data Retention

Information is retained only for as long as necessary to provide the Services, support reporting and audit requirements, meet customer contractual obligations, support investigations where applicable, and comply with legal and regulatory requirements. Retention periods may vary depending on the service plan, contractual terms, and applicable laws.

Compliance and Governance

Drosera is designed to support enterprise governance, risk, and compliance requirements and may align with recognized frameworks such as GDPR, SOC 2, ISO 27001, and cyber resilience control frameworks, depending on customer deployment and subscription scope.

User Rights

Subject to applicable law, individuals may have rights relating to access, correction, deletion, restriction, or objection to the processing of their Personal Data. Such requests may be submitted through the customer’s designated administrator or directly to our privacy and compliance team.

Changes to this Policy

We may update this Privacy Policy from time to time to reflect product enhancements, legal obligations, operational changes, or regulatory requirements. Any updates will be published on this page with the revised effective date.

Contact Information

For privacy, compliance, or data protection inquiries, please contact the Privacy & Compliance Team at info@drosera.ai.