AEGISYST
AI Detection Engineering
Legal

Privacy Policy

Last updated: September 4, 2026

1. Who we are

Aegisyst is operated personally by the site owner (referred to as "we", "us", or "Aegisyst") and is reachable at support@spectreai.in. This site (aegisyst.com) is the sole point of contact.

2. Data we collect

  • Account data (email & password sign-in): email address, bcrypt-hashed password, role (Admin / Analyst / Viewer / Guest), and account creation timestamp.
  • Account data (Google Sign-In): Google email address, display name, and public profile picture URL provided by Google OAuth. We do not receive your Google password. We do not request access to Gmail, Drive, Calendar, or any Google services beyond basic profile identity.
  • Guest mode: Guest sessions do not create a persistent account. Actions taken as a Guest are ephemeral to the demo dataset only.
  • Product data you create: detection rules, threat-intel notes, sandbox test logs you upload, SIEM connector configurations, and audit-log entries generated by your actions. SIEM connector secrets (Splunk HEC tokens, Elastic API keys, Sentinel client secrets) are stored server-side only and are irreversibly redacted (****) in every API response.
  • Anonymous access telemetry: a per-browser-session random UUID is generated on your device (rotated when you close the browser tab), SHA-256 hashed with a rotating server-side salt, and stored purely to count total and unique daily visits. No IP addresses, user agents, referrers, or device fingerprints are collected or stored. Session hashes auto-expire after 30 days.
  • Authenticated-user analytics: upon successful sign-in we record a SHA-256 hash of your user_id combined with a daily-rotating salt — the hash is not reversible, cannot be linked across days, and is deleted after 30 days. Only aggregate counts ("today", "last 7 days") are surfaced to admins. Your email, name, and identity are never present in this analytics dataset.
  • Community verifications: when you click “Verify” on a rule in the public Intelligence Library (/feed), we store your account id and email alongside the rule id so each account can verify a rule only once (and undo it). Only the aggregate count is public — the list of who verified a rule is never exposed through the API or UI.
  • Threat feed data: the Active Threats queue is built from public sources (CISA KEV, the SigmaHQ repo, MalwareBazaar). We store the public threat metadata plus, per user, which threats you dismissed from your own banner. No customer data is ever sent to those sources — the poller only reads from them.
  • Billing data: if you upgrade to Team, your payment is processed by Razorpay (India / INR) or Stripe (global / USD). Aegisyst stores only the resulting subscription state and a Razorpay/Stripe reference ID — we never see or store your card number, CVV, UPI ID, or bank details.
  • Technical logs: standard server logs (kept in-memory only, not persisted beyond process lifetime) used for real-time abuse investigation.

2a. Google Sign-In & OAuth scope

When you choose "Sign in with Google", you are redirected to Google's authentication service. Google returns a signed identity assertion containing only your email, name, and picture URL to Aegisyst — the minimum needed to create your account. We do not receive or store any access to your Google account beyond this identity information. You may revoke Aegisyst's access at any time from your Google Account permissions page.

2b. Public Intelligence Library (/feed)

The Intelligence Library is a publicly readable feed and requires no account to browse. Anonymous browsing is covered by the same privacy-safe access telemetry described above — no IP, user agent, or fingerprint is stored. Rules published to the library are either Aegisyst-authored curated content or rules an administrator has explicitly pinned; your private rules are never published to the library without an explicit admin pin action, and the feed only ever exposes the rule title, MITRE ATT&CK tags, the detection-logic summary, and a truncated preview — never the full detection content.

2c. Deception Module data

If your account is on the Enterprise tier and you use the Deception Module, we store only the decoy artefact names you choose (e.g. srv_metabase_admin), any optional domain label and placement note you type, and the generated rule content — the same way we store any other rule you create. No credentials are generated, requested or stored, and Aegisyst never connects to your directory to create or authenticate the decoy account. Logic randomization is computed server-side from the rule you already hold; the randomized output is returned to your browser and is not persisted unless you save it as a rule.

3. How we use the data

  • To provide the Aegisyst service (authentication, rule storage, audit logging).
  • To improve the product (aggregated analytics).
  • To investigate security incidents or terms-of-service violations.
  • To respond to your support requests.

We do not sell your data. We do not share it with advertisers.

4. Third-party processors

  • Google (OAuth 2.0 via Emergent): handles authentication if you choose "Sign in with Google". Google receives only the fact that you signed in; Aegisyst receives back your email, name, and profile picture URL. Google's use of this data is governed by Google's Privacy Policy.
  • OpenAI (via Emergent): Rule-generation prompts contain the MITRE technique ID and a short natural-language description of the intended detection. Uploaded sample logs, alert data, and IoCs are never sent to the AI provider.
  • Razorpay (payments — India): processes your INR payment for the Team plan. Governed by Razorpay's Privacy Policy. Card / UPI / netbanking details go directly to Razorpay and never touch Aegisyst servers.
  • Stripe (payments — global): processes your USD payment for the Team plan. Governed by Stripe's Privacy Policy. Card details go directly to Stripe and never touch Aegisyst servers.
  • CISA KEV & abuse.ch MalwareBazaar (public threat feeds): outbound-only requests to fetch public vulnerability and malware sample metadata. No user data is transmitted.
  • Your configured SIEM endpoints: when you enable a Splunk / Elastic / Microsoft Sentinel connector, Aegisyst makes outbound API calls to your infrastructure using the credentials you provided. No data is ever sent to any SIEM you did not explicitly configure.
  • Emergent (hosting): Application hosting and MongoDB database.

4a. India DPDP Act 2023 compliance

For users in India, Aegisyst acts as a Data Fiduciary under the Digital Personal Data Protection Act, 2023. We process personal data only for the specific, lawful purposes disclosed on this page. You have the right to:

  • Access a copy of your personal data.
  • Correct inaccurate or misleading data.
  • Erasure — request deletion of your data (subject to statutory retention).
  • Nomination — nominate another individual to exercise your rights.
  • Grievance redressal — email support@spectreai.in. We respond within statutory timelines.

Our lawful basis for processing is your informed consent (given by using the Service and, for Google sign-in, by proceeding through Google's consent screen). You may withdraw consent at any time by deleting your account.

5. Data retention

Account and product data are retained for the lifetime of your account. On deletion request (email support@spectreai.in), we remove your data within 30 days. Server logs are auto-purged after 30 days.

6. Security

Passwords are hashed with bcrypt. All traffic is TLS 1.2+ encrypted. Access is role-based (RBAC). A tamper-evident audit log records every rule change, approval, and export.

7. Your rights (GDPR / DPDP)

  • Right to access — request a copy of your data.
  • Right to rectification — correct inaccurate data.
  • Right to erasure — delete your account and data.
  • Right to data portability — export your rules and audit log.

Email support@spectreai.in to exercise any of these.

8. Cookies

Aegisyst uses two first-party cookies, both strictly necessary:

  • session_token — httpOnly, Secure, SameSite=None. Set when you Sign in with Google. Expires after 7 days. Used to keep you signed in.
  • aegisyst_user — localStorage cache of your non-sensitive profile (name, email, role) used to hydrate the UI on refresh. Session identity itself is held in an httpOnly cookie set by our server — never in JavaScript-accessible storage.

No third-party advertising, tracking, or cross-site cookies are used. No consent banner is shown because we do not use any non-essential cookies.

9. Changes to this policy

Material changes will be posted on this page with a new "Last updated" date. Continued use of Aegisyst after changes constitutes acceptance.

10. Contact

Questions? Email support@spectreai.in.