Privacy Policy

Last updated: October 22, 2026

SIEMonster Inc. (“SIEMonster”, “we”, “us” or “our”) provides the Edg3 security platform and operates the edg3.io website. This policy explains what personal information we collect, how we use and share it, and the choices and rights you have.

1. Who we are
2. Scope and our role
3. Information we collect
4. How we use information
5. Legal bases (EEA, UK and Switzerland)
6. How we share information
7. Service providers
8. Retention
9. Security
10. International transfers
11. Your privacy rights
12. Cookies and similar technologies
13. Children
14. Changes to this policy
15. Contact us

1. Who we are

Privacy contact: privacy@edg3.io

2. Scope and our role

This policy covers visitors to edg3.io, prospective customers and others who contact us, our customers’ account, billing and user information, and how the Edg3 platform processes the security data our customers send to it.

For information we collect to run our own business (the website, sales, accounts and billing), we decide how it is used; in GDPR terms we are the “controller”.

The telemetry, logs and other content a customer sends to the platform, and the alerts, cases and investigation results the platform produces from it (“Customer Data”), belong to that customer. We process Customer Data on the customer’s behalf and on its instructions, as its service provider (a “processor” in GDPR terms). The customer decides what to collect and is responsible for any notices to, and consents from, the people whose information appears in it, such as its employees. If your information is in a customer’s Customer Data, please contact that customer; we will help it respond.

3. Information we collect

Website visitors

The edg3.io pages contain no analytics scripts, advertising tags or tracking pixels, and they set no cookies.

Our web server logs each request: your IP address, the date and time, the page or file requested, the response status and size, the referring page and your browser’s user-agent string. An open-source tool running on our own server turns these logs into traffic reports (for example pages viewed, referrers, browser types, and country, which is looked up from the IP address in an offline database). The reports are stored in our AWS account and can include IP addresses.

Our pages load their fonts from Google Fonts, so your browser also sends your IP address and standard request information to Google (see Section 7).

People who contact us

The website has no contact forms. If you email us, for example at sales@edg3.io or privacy@edg3.io, we receive your name, email address, any company details and whatever you include in your message. We receive email through our email hosting provider.

Customers: ordering and billing

When you buy a plan through our online checkout, we collect your company name, your first and last name, email address, phone number, company size, industry and country; optionally your job title, how you heard about us and any domains you want monitored for dark-web exposure; and the plan and billing period you choose. We derive a tenant identifier and the web address of your instance from your company name. If you buy through our sales team, we collect similar contact and billing details as part of that process.

Payments are processed by Stripe. You enter your card and billing details on a payment page hosted by Stripe; we do not receive or store your full card number. Stripe tells us the payment status, amount and currency, and gives us references to the payment and to your Stripe customer record.

We keep order and provisioning records, including the status history of your order and of your instance’s deployment.

Customers: console users

For people who use the Edg3 console we hold account details (such as name, email address and role), authentication data (such as a hashed password and two-factor settings) and records of sign-ins and actions, including the identity of the analyst who approves a response action. We send service emails such as account activation, password reset, two-factor notices and cancellation reminders.

Customer Data processed by the platform

On each customer’s behalf, the platform processes:

• Endpoint telemetry from the Edg3 agent. Depending on the operating system and configuration: Windows event logs (including Sysmon and other configured channels), PowerShell script text, DNS queries, and connections of USB and other removable devices (including their device IDs); Linux process (with command lines), audit, syslog and authentication logs; and, on every operating system, file-integrity monitoring of system folders and, on Windows, of the users’ folders under C:\Users (file names, changes and file hashes), software inventory, security posture checks, and local user accounts with their privilege level, password age and last sign-in. These records can contain user names, host names, IP and other network addresses, file paths and hashes, command lines and script text, process and network activity, and installed software and patch levels.
• Logs and events from other sources the customer connects, such as syslog sources and AWS CloudTrail for configured accounts.
• Device location: each device’s public IP address, network details, cloud region where available, and an approximate location (such as city and country) looked up from the public IP address in an offline database.
• Security records: detections, alerts, cases, analyst notes and dispositions, and response actions such as host isolation and forensic collection, including the material a forensic collection gathers from a host.
• Automatic forensic collection: when a critical detection on a device matches certain attack techniques, the platform automatically asks the Edg3 agent on that device for forensic data, without an analyst’s approval. For credential theft, it asks for the values of one Windows registry key that holds security settings, not stored accounts or passwords. For remote access to other systems, it asks for the device’s network connections and a list of recent event-log entries. For commands or scripts being run, it asks for the running processes with their command lines, the program libraries (DLLs) they have loaded, and a list of recent event-log entries. For command-and-control network traffic, it asks for the device’s network connections. Command lines and file paths can contain user names and other personal information. The event-log list gives each entry’s ID, source and time, not its contents. A memory capture of the Windows credential store (LSASS) is never collected automatically. A console Admin can also start a collection by hand. Collection results are stored in our AWS environment, outside the customer’s instance, separated by customer. Any signed-in user of the customer’s console can view them, and only the customer’s Analysts and Admins can download the full evidence bundle. They have no set deletion date, and deleting the customer’s instance does not delete them.
• Dark-web monitoring: the domains and organization names the customer asks us to monitor. The platform compares them with publicly available ransomware leak-site listings that it downloads; the monitored domains are not sent to the listing provider.
• AI investigation data, described next.

AI-assisted investigations

• Automatic triage. The platform builds a bounded evidence summary from the customer’s own data and sends it to the inference endpoint selected for the tenant. By default that is a model server we operate on AWS, which is shared across customers.
• On-demand investigations. When a user selects “Investigate now”, the platform sends an evidence summary about the selected host or user to the same model server we operate on AWS. It does not use an outside AI provider. The summary is built from the tenant’s own data and can include user names, host names, the detections involved, account details such as privilege level and password age, and approximate location.
• Model-call records. Calls to the triage model pass through a recording layer that logs latency, usage and outcome in the customer’s tenant. Credentials and other secret-shaped values are redacted from that record by default; user names, host names, IP addresses and command lines are kept as observed.
• Results. Investigation results and analyst dispositions are kept in the tenant. They can inform a separately governed model-evaluation process; they do not automatically retrain a production model.

Security tooling

Our web application firewall and intrusion-prevention tools process IP addresses and request details to detect and block attacks on our services.

4. How we use information

• To provide, operate and support the Services: create and run your instance, deliver the agent, process Customer Data as you instruct and answer support requests.
• To process orders and payments and manage subscriptions and cancellations.
• To send service communications, such as activation, sign-in security, billing and cancellation notices.
• To secure the Services: authenticate users, rate-limit requests, prevent fraud and abuse, and detect and respond to attacks.
• To protect all customers with threat intelligence: we correlate high-severity detections across customer instances with our threat-intelligence database to find threats that affect more than one customer.
• To understand and improve our website, using the traffic reports described above.
• To answer your enquiries and, where the law allows, tell you about Edg3. You can opt out of marketing email at any time.
• To comply with the law, enforce our Terms of Service, and establish or defend legal claims.

We do not sell personal information, and we do not use or share it for targeted (cross-context behavioral) advertising.

5. Legal bases (EEA, UK and Switzerland)

If the GDPR or a similar law applies, we rely on:

• Contract: to provide the Services, process orders and payments, and manage accounts.
• Legitimate interests: security and fraud prevention, website traffic reports, answering enquiries and business communications, cross-customer threat intelligence, and improving the Services. We weigh these interests against your rights.
• Legal obligation: tax, accounting and other legal requirements.
• Consent, where we ask for it. You can withdraw consent at any time.

For Customer Data, the customer determines the legal basis, and we process it on the customer’s instructions.

6. How we share information

We share personal information only:

• with service providers that process it for us under contract, and with services a customer chooses to enable (Section 7);
• with a managed security service provider (MSSP), where a customer uses Edg3 through one or authorizes one. The partner receives that customer’s summaries and its critical and high-severity alerts, which include host names; can look into the customer’s recent alerts, including user names, IP addresses and command lines; and can request response actions such as host isolation;
• when required by law or legal process, or to protect the rights, property or safety of SIEMonster, our customers or others;
• in connection with a merger, acquisition, financing or sale of assets, subject to this policy; and
• with your consent or at your direction.

7. Service providers

These providers process personal information for us:

These services receive data only when a customer enables or uses the related feature:

When you use the console’s map views, your browser also loads map tiles from CARTO and, if you choose the satellite or terrain layer, from Esri or OpenTopoMap. These providers receive your IP address and standard request information.

To learn a device’s public IP address, the Edg3 agent may query the public IP-echo services icanhazip.com and api.ipify.org, which see that address. This can be turned off for a customer’s devices.

Our team may also receive internal operational alerts in a team messaging tool (Slack or Microsoft Teams), for example when an instance is deployed or cancelled, or when the agent on a device loses events or runs low on disk space. These alerts contain a customer’s tenant identifier, instance web address and plan, and can include the instance’s public IP address and the host names of the customer’s monitored devices. They do not include contact details.

8. Retention

We keep personal information only as long as we need it for the purposes in this policy:

• Website server logs: about 14 days.
• Enquiries: as long as needed to respond and to maintain our business relationship.
• Account, order and billing records: for the life of your account and afterwards as long as needed for tax, accounting and legal purposes.
• Customer Data: for at least the retention period of your plan, shown on our pricing page or in your order, while your subscription is active. If you cancel, your instance and Customer Data remain available for 30 days from the cancellation date so you can export your data, and then we permanently delete your instance, including its databases and cloud storage, however much of your paid term remains. If your term ends without a new purchase, or we end your subscription, we record a cancellation on that date and the same 30-day period applies. Some copies and records remain after that deletion:
  • backups of your instance’s databases, for up to 35 days;
  • backups of our account and order database, for about 37 days; and
  • records we hold outside your instance, which have no set deletion date yet: the vulnerability scan reports you uploaded, forensic collection results, records of response actions, and our registry of your enrolled devices (such as their host names and operating systems).
• AI investigation records are part of Customer Data. Investigations use no outside AI provider.

9. Security

• Each customer has a dedicated cloud instance, with its data kept under a per-tenant storage path. Some records are held in shared systems and kept separate by customer: each customer’s own databases on a shared database cluster, and shared tables such as our registry of enrolled devices and the records of forensic collections.
• Connections to the website, the checkout, the console and the agent’s messaging service are encrypted in transit.
• Console access uses role-based permissions and supports two-factor sign-in. Host isolation requires a recorded analyst approval, except automatic ransomware containment. Only a console Admin can start a forensic collection by hand; the platform also collects some forensic data automatically, as described in Section 3.
• Card details are handled by Stripe and do not reach our servers.

No method of transmitting or storing information is completely secure, and we cannot guarantee absolute security.

10. International transfers

We are based in the United States and host the Services on AWS in the United States, primarily in the us-east-2 (Ohio) region. If you are outside the United States, your information is transferred to and processed in the United States, where data protection laws may differ from those where you live. Our service providers may process information in other countries.

Where the law requires it, we protect transfers from the EEA, the UK and Switzerland with appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and their UK and Swiss equivalents.

11. Your privacy rights

Depending on where you live, you may have the right to know about and access your personal information, correct it, delete it, receive a portable copy, opt out of certain processing, and not be treated differently for exercising these rights.

US state privacy rights

If you live in California or another US state with a comprehensive privacy law, you have the rights above, subject to the exceptions in those laws. In the last 12 months we have collected these categories of personal information:

• identifiers, such as name, email address, phone number, IP address, and account and tenant identifiers;
• commercial information, such as the plans you bought and order and payment status;
• internet or network activity, such as web server logs and console sign-in and activity records;
• approximate geolocation, derived from IP addresses;
• professional information, such as company, job title, company size and industry; and
• account login credentials, which we use only to authenticate you.

We collect this information from you, your organization, your devices and browser, and Stripe, for the purposes in Section 4, and disclose it to the recipients in Sections 6 and 7. We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the last 12 months. We do not use sensitive personal information to infer characteristics about you.

You can make a request yourself or through an authorized agent; we may ask an agent for proof of authorization and verify your identity. If we decline your request, you can appeal by replying to our decision or emailing privacy@edg3.io with “Appeal” in the subject line. If we deny your appeal, you can contact your state attorney general.

EEA, UK and Switzerland

You have the right to access, rectify and erase your personal information, to restrict or object to its processing (including processing based on legitimate interests and direct marketing), to data portability, and to withdraw consent. You can also complain to your local data protection authority.

How to make a request

Email privacy@edg3.io. We will verify your request, usually by confirming you control the email address we hold, and respond within the time the law requires. If your request concerns Customer Data we process for one of our customers, we will refer you to that customer and help it respond.

12. Cookies and similar technologies

• edg3.io pages set no cookies and use no local storage, analytics or advertising tags (see Section 3).
• Checkout pages set one strictly necessary session cookie that holds a security token protecting the checkout form against cross-site request forgery. It is sent only over HTTPS, cannot be read by page scripts, is not sent with requests from other sites, and expires when you close your browser. When you continue to payment, Stripe’s payment page may set its own cookies, which Stripe’s privacy policy governs.
• The console uses strictly necessary cookies to keep you signed in and protect your session. Its map views load map tiles from CARTO, Esri and OpenTopoMap, as described in Section 7.

We do not use cookies for analytics, advertising or cross-site tracking, so there is nothing to opt out of. We treat a browser privacy signal such as Global Privacy Control as a request to opt out of the sale or sharing of personal information, which we do not do in any case.

13. Children

The Services are for businesses and are not directed to children. We do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, contact privacy@edg3.io and we will delete it.

14. Changes to this policy

We may update this policy. We will post the new version here with a new “Last updated” date. If a change is material, we will tell customers by email or in the console before it takes effect.

15. Contact us

Questions or requests about this policy: privacy@edg3.io