Privacy Terms

CISONexus ("we", "us") provides an enterprise resource planning platform for Chief Information Security Officers and their teams, available as a cloud service and as an on-premise deployment. This page explains what personal data we collect through cisonexus.com and the CISONexus platform, why we collect it, and the terms that govern use of both.

For workspace content processed on behalf of our customers (risks, incidents, evidence and similar records), the customer is the data controller and CISONexus acts as a processor under the customer agreement. For on-premise deployments, workspace content never leaves the customer’s own infrastructure.

We collect only what we need to operate the website and the platform:

• Account data: name, work email, job title, phone, and authentication data (a salted password hash, two-factor secrets, session records).
• Forms you submit: demo requests, contact messages and whitepaper downloads, including your name, work email, company and country.
• Public AI CISO chat: the questions you type and the answers generated. Sessions are anonymous; we ask you not to include personal or confidential information, and we log topic-level analytics only.
• Workspace content: records your organization creates in the platform, processed solely to provide the service.
• Technical data: IP address, browser type, and security events (sign-ins, failed attempts) kept for account protection and audit trails.
• Local storage: theme preference and, for the public chat, your conversation history, which is stored only in your own browser and never synced to us.

• To provide, secure and improve the platform and website.
• To respond to demo requests, support cases and messages you send us.
• To deliver content you request, such as whitepapers, by email.
• To protect accounts: session management, two-factor authentication, abuse detection, and immutable audit logs.
• To send operational emails. We do not send marketing email unless you have asked for it, and every such email includes a way out.

We do not sell personal data, and we do not use workspace content to train AI models.

Nexus Brain and the AI agents process your workspace records to produce answers, triage verdicts and drafts. Where a large language model is used, prompts are sent to the configured model provider strictly to generate the response.

The public AI CISO chat routes questions through our model gateway with a system instruction that prohibits requesting personal data. Conversations are anonymous and are not used to train models. AI outputs are decision support: they can be incomplete or wrong, and they are not legal, compliance or professional advice. You remain responsible for decisions made in your security program.

The cloud service relies on a small set of infrastructure providers:

• DigitalOcean: application and database hosting.
• Cloudflare: DNS, content delivery and edge security.
• Resend: transactional email delivery (form notifications, whitepaper delivery).
• OpenRouter: AI model gateway for the public AI CISO chat.

On-premise deployments run entirely on your own infrastructure: none of these subprocessors receive your workspace content.

To exercise any right, email [email protected] from the address concerned. We verify every request and respond within 30 days. If your data lives in a customer workspace, we may direct the request to that customer as the controller.

• Account data is kept while your account is active and deleted on verified request after closure.
• Workspace content is retained under your organization’s agreement; full JSON export is available at any time.
• Form submissions are kept as business records until you ask us to delete them; security and audit logs follow the platform’s configured retention.
• Depending on your jurisdiction (including under GDPR), you may request access, correction, deletion, portability, or restriction of processing.

By using cisonexus.com or the CISONexus platform ("the Service") you agree to these terms. If you use the Service on behalf of an organization, you confirm you are authorized to bind it, and any signed agreement between that organization and CISONexus prevails where it differs.

CISONexus is offered as a cloud subscription and as an on-premise deployment operated on your own infrastructure. Access is provisioned by CISONexus or your workspace administrator: there is no public self-registration, and access begins with a demonstration and an agreement.

• You own your workspace content: everything your organization records in CISONexus remains yours.
• We process it only to provide the Service, under your agreement and this page.
• You can export your workspace as structured JSON at any time. Your data is never locked in.
• On-premise deployments keep all workspace content on infrastructure you control.

You agree not to misuse the website or the Service. In particular, do not:

• Attempt to access accounts, workspaces or data that are not yours.
• Probe, scan or test the vulnerability of the Service except under written authorization from CISONexus.
• Use the Service, including the AI features and the public AI CISO chat, to develop malware, plan attacks against third parties, or engage in any unlawful activity.
• Resell, sublicense or provide the Service to third parties outside your agreement.
• Interfere with the integrity or performance of the Service, or circumvent usage limits.

Security researchers: we welcome coordinated disclosure. See the Security page for how to report a vulnerability safely.

• Keep credentials confidential and enable two-factor authentication; you are responsible for activity under your account until you notify us of unauthorized use.
• We may suspend access that presents a security risk to the Service or other customers, restoring it once resolved.
• We work to keep the cloud service continuously available; service-level commitments, if any, are defined in your subscription agreement.
• CISONexus and its licensors own the Service and its content. You receive a limited, non-exclusive, non-transferable right to use it under your agreement, and may share our published resources freely in unmodified form with attribution.

The website and its content are provided "as is" for general information. To the maximum extent permitted by law, CISONexus disclaims implied warranties and is not liable for indirect, incidental or consequential damages arising from use of the website. For platform customers, liability caps and remedies are defined in the subscription agreement. Nothing here limits liability that cannot be limited by law.

Platform subscriptions end per their agreement; on termination we provide a window to export your workspace, after which cloud data is deleted on the retention schedule above. We may terminate or suspend access for material breach that remains uncured after notice.

When this page changes materially we will update the date at the top and, for significant changes affecting platform customers, notify workspace administrators. Continued use after a change means the updated version applies. Questions: [email protected].