Privacy Policy for BlueRock Security

Effective Date: September 1, 2026

Last Updated: September 1, 2026

At BlueRock Security (“we,” “us,” or “our”), safeguarding the data of our clients, partners, and platform users is foundational to our operations. This Privacy Policy outlines our standards and practices regarding the collection, processing, storage, disclosure, and protection of personal and operational data in accordance with global industry frameworks, including the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and ISO/IEC 27001 data governance guidelines.

1. Information We Collect

We strictly limit data collection to operational, technical, and regulatory requirements. Depending on how you interact with our security services, software, or website, we may collect the following categories of data:

A. Direct & Identity Information

  • Account & Contact Data: Name, business email address, phone number, job title, and employer/company name.
  • Billing & Administrative Metadata: Payment information, invoices, signed Non-Disclosure Agreements (NDAs), and Statements of Work (SOWs).
  • Identity Verification Details: Verification credentials, government identification (where strictly required for compliance or access controls), and security clearance verifications.

B. Technical & Operational Telemetry

  • Security & Infrastructure Logs: IP addresses, authentication timestamps, system event logs, access logs, network request details, and browser/system diagnostics.
  • Service Usage Data: Interactive feature metrics, telemetry from security monitoring agents, threat vectors evaluated, and client deployment parameters.
  • Cookies & Technical Identifiers: Session identifiers and preference state cookies used for essential site functions, security validation, and performance analytics.

2. How We Use and Process Your Data

BlueRock Security processes personal and system data solely for legitimate business, operational, and legal purposes:

  • Service Delivery & Defense Operations: Operating, maintaining, and deploying our cybersecurity monitoring, threat detection, and incident response tools.
  • Authentication & Access Control: Verifying identities, enforcing role-based access control (RBAC), and preventing unauthorized system access.
  • System Improvements & Security Analysis: Monitoring service performance, analyzing aggregated threat intelligence, and enhancing system architecture.
  • Client Communications & Support: Responding to inquiries, issuing critical security alerts, and providing operational status updates.
  • Legal & Regulatory Compliance: Fulfilling statutory requirements, assisting in legitimate law enforcement inquiries, and upholding contractual obligations.

3. Data Protection and Zero-IP Leakage Standards

As a security organization, we enforce strict controls to ensure data integrity, confidentiality, and technical protection:

Security Controls & Architecture

  • Encryption Standards: Data in transit is protected using TLS 1.3 protocols, and sensitive data at rest is encrypted using AES-256 standards.
  • Access Control & Authentication: Internal systems enforce multi-factor authentication (MFA) and strict least-privilege Access Control Lists (ACLs).
  • Audit Trails: Immutable Security Information and Event Management (SIEM) logging monitors internal database inquiries, administrative access, and data exports.

Zero-IP Leakage & Model Protection

  • Client source code, proprietary telemetry, and internal documentation are strictly isolated.
  • BlueRock Security does not sell, rent, or trade client or personal data to third parties.
  • Private client data and code repositories are never utilized to train public machine learning models or external artificial intelligence algorithms without explicit written authorization.

4. Disclosure and Third-Party Sharing

We share data only under strictly bounded conditions:

  1. Vetted Service Providers: Third-party cloud infrastructure, data center, and analytics vendors under contract. All sub-processors are required to comply with equivalent data protection agreements (DPAs) and security standards.
  2. Legal & Regulatory Requirements: Disclosures required by court orders, search warrants, statutory reporting, or formal regulatory compliance obligations.
  3. Corporate Restructuring: Data transfers resulting from a business merger, asset sale, or organizational acquisition, subject to the recipient adhering to this policy.

5. Retention and Destruction

  • Retention Window: Data is retained only for as long as necessary to fulfill the operational purposes for which it was collected, or as mandated by statutory compliance regulations (e.g., audit trails, tax records, or legal holds).
  • Secure Sanitization: When retention periods expire, physical records are securely destroyed, and electronic storage media undergo cryptographic erasure or sanitization complying with NIST standards.

6. Your Data Rights

Depending on your regulatory jurisdiction (such as under GDPR or CCPA/CPRA), you retain specific rights over your personal data:

  • Right to Access / Know: Request details regarding the categories and specific pieces of personal information we maintain.
  • Right to Rectification: Request correction of inaccurate, out-of-date, or incomplete data.
  • Right to Erasure (“Right to be Forgotten”): Request deletion of personal records, subject to statutory retention limits.
  • Right to Opt-Out / Restrict Processing: Request restriction of processing activities or opt out of specific communications.
  • Non-Discrimination: We do not discriminate against any individual for exercising their legal privacy rights.

To submit a verified data rights request, please email our Data Protection Office at support@bluerock.io.

7. Updates to This Policy

We may update this Privacy Policy periodically to reflect technological changes, security industry updates, or regulatory evolving standards. Revisions will be published on this page with a revised “Last Updated” date.

8. Contact Information

For inquiries, concerns, or data requests regarding BlueRock Security's data handling practices, contact us at: