Last updated 19 October 2026
Privacy policy
In plain English
ThreatBreaker can run entirely on your own infrastructure, including fully air-gapped. In that case no endpoint data reaches us at all.
If you use our cloud console, the agent sends security event metadata: process names, command lines, file hashes, network connections. It does not send file contents. Screenshots and file uploads happen only when one of your operators asks for them, and every retrieval is logged. Your data is isolated from other customers, encrypted in transit and at rest, and you can permanently delete it.
On this website we collect what you type into our forms, and, with your consent where the law requires it, analytics and the name of the company you visit from. We never sell personal data.
Questions: al@threatbreaker.com.
1. Who we are and what this policy covers
ThreatBreaker is a product of TBCS Inc. (ThreatBreaker CyberSecurity), a Delaware corporation with its business address at Capital Factory, 701 Brazos St, Austin, TX 78701, United States (“we” or “us”). This policy explains how we handle personal data on threatbreaker.com and in the ThreatBreaker service: the web console, the License Manager and the endpoint agent.
| Data | Our role | Who decides |
|---|---|---|
| Website visitors, form submissions, marketing, sales and partner contacts | Controller | TBCS Inc. |
| Console accounts, billing and financial records | Controller | TBCS Inc. |
| Endpoint data, direct SaaS customers | Processor | The customer |
| Endpoint data, customers served through an MSSP | Sub-processor (the MSSP is the processor) | The end customer |
| Endpoint data in on-premise or air-gapped deployments | None: we never receive it | The customer |
Where we act as processor or sub-processor, we handle endpoint data only on documented instructions, under our Data Processing Agreement (available on request at al@threatbreaker.com) and the MSSP’s own agreements with its clients. People whose devices a customer protects should contact that customer first.
2. Data we collect on our website
| What | When | Why (legal basis) | Where it goes |
|---|---|---|---|
| Name, email, company, country, partner type, endpoint range, message | You submit the partner or investor-updates form | To reply and follow up (legitimate interests; consent for updates) | HubSpot CRM; an email notification to our team |
| Name, email, chosen time, answers | You book a demo or investor call | To hold the meeting (contract / legitimate interests) | HubSpot Meetings |
| Pages viewed, referrer, device, approximate location, clicks on buttons | You browse the site | To see which content is useful (consent in the EEA, UK and Switzerland; legitimate interests elsewhere) | Google Analytics 4 |
| The company or person associated with your IP address | You browse the site | To recognise companies that visit and follow up (consent in the EEA, UK and Switzerland; legitimate interests with an opt-out elsewhere) | Fuse (visitor identification) |
| Your consent choice, a dismissed announcement | You make the choice | To remember it | Your browser only (local storage) |
Consent. Visitors in the EEA, UK and Switzerland see a cookie notice. Until they accept, Google Analytics runs in Consent Mode without setting cookies, and the Fuse script does not load. Visitors anywhere can opt out at any time with (also in the site footer); choosing Decline stops visitor identification on later visits.
What we do not do. We do not sell personal data or share it for cross-context behavioural advertising. Advertising storage is disabled in Google Analytics everywhere.
Spam protection. Forms include a hidden field that automated bots fill in; such submissions are discarded and not stored.
3. Data in the ThreatBreaker service
Deployment decides whether we see anything. In SaaS, we operate the console and License Manager on OVHcloud: European customers in Warsaw, Poland (EU), and other customers in Canada. European customer environments are not hosted in Canada. On-premise and air-gapped deployments run the console on the customer’s own host; air-gapped licences are verified locally with no call home, so no endpoint data reaches us. In the federated model, regional dashboards send the Master License Manager anonymised telemetry only.
What the agent sends (SaaS). By default the agent sends event metadata, not file contents:
- process start and stop, with command line, parent process, SHA-256 hash and code-signing status;
- network connections and outbound data volume by process and destination;
- detection records: the rule or model that fired, MITRE ATT&CK mapping, severity;
- host details: hostname, operating system, IP address, agent version.
Command lines and file paths can contain user names and other personal data. Screenshots and file uploads happen only on an explicit operator request, and every retrieval is listed in the host’s command history.
Console users. We hold each user’s name, email, role, tenant and login and audit records to run the account and keep it secure.
AI investigation. Core detection and incident analysis run on ThreatBreaker’s own models; no third-party AI provider receives customer data by default. Customers may optionally connect a third-party AI provider for extra enrichment (supported: OpenAI, Anthropic, xAI and Jev) using their own API key. That provider then processes data under the customer’s own agreement with it, in the locations it uses. Operators can switch AI enrichment off at any time.
Threat intelligence. VirusTotal is an optional integration, off by default. It runs only when a customer enables it with its own VirusTotal API key, under the customer’s own terms with VirusTotal; we do not send customer data to VirusTotal otherwise. Public threat-intelligence feeds are downloaded to agents; this sends no customer data out.
Security. Agent traffic uses TLS 1.2 or 1.3 with public-key pinning, HMAC signatures and replay protection. Tenants are isolated and data is encrypted at rest. Agent configuration and quarantined files are encrypted with AES-256-GCM (DPAPI on Windows).
Retention and deletion. Standard SaaS retention:
| Data | Kept for |
|---|---|
| Raw endpoint telemetry and events | 30 days |
| Incidents and forensic investigations | 180 days |
| Administrative and security audit logs | 365 days |
| Backup copies | 30 days |
| Customer data after the contract ends | 30 days, with a chance to export first |
| Residual backups after the contract ends | up to 60 days |
Enterprise customers can agree longer periods by contract, and we keep records longer where the law requires it. Operators with delete rights can purge data permanently; the audit log keeps a tombstone of who deleted what and when, without the content.
4. Service providers, transfers and your rights
Service providers (sub-processors). We use these providers to run the website and the service:
| Provider | Purpose | Processing location |
|---|---|---|
| OVHcloud | SaaS console and License Manager hosting | Warsaw, Poland (EU customers); Canada (others) |
| Vercel | Website hosting and form handling | United States / global edge |
| HubSpot | CRM, form records, meeting scheduling, email notifications | United States |
| Google (Analytics 4) | Website analytics | United States |
| Fuse | Website visitor identification | United States |
| Google Workspace | Business email | United States |
Optional integrations a customer turns on with its own keys (third-party AI providers, VirusTotal) are not our sub-processors: the customer contracts with them directly. We will notify customers before adding a sub-processor that handles their endpoint data.
International transfers. EU customer environments are hosted in the EU (Warsaw, Poland). Where personal data does leave its region, we use an appropriate safeguard: the EU adequacy decision for Canada where its conditions are met; the EU-US Data Privacy Framework for certified recipients or the EU Standard Contractual Clauses for transfers to the US; and the UK International Data Transfer Agreement or UK Addendum for UK data. Remote support or administrative access from outside the EEA counts as a transfer and is assessed the same way. Customers who need data to stay on their own network can deploy on-premise.
Your rights. Depending on where you live (including under the GDPR, UK GDPR and California’s CCPA/CPRA), you can ask to access, correct, delete or export your personal data, object to or restrict processing, and withdraw consent. Email al@threatbreaker.com; we answer within 30 days. EU and UK residents may also complain to their data protection authority. We do not discriminate against anyone for exercising these rights.
Security incidents. We notify affected customers of a personal data breach without undue delay and, where feasible, within 24 hours of becoming aware of it, with what we know of its nature, the data affected, the likely impact and the steps taken. This supports customers and MSSPs in meeting their own notification duties.
Children. Our services are for businesses and are not directed at children under 16.
Changes. We date every version of this policy and announce material changes on this page and by email to customers.
Contact. TBCS Inc., Capital Factory, 701 Brazos St, Austin, TX 78701, United States. Privacy questions and requests: al@threatbreaker.com.
EU representative. Under Article 27 of the GDPR, our representative in the European Union is Andrii Linskyi, Baba Novac St. 5, Office 22, Sector 3, Bucharest 31622, Romania, al@threatbreaker.com.
Prefer that no data leaves your network? ThreatBreaker runs fully on-premise, offline or air-gapped. See how deployment works