Privacy Policy

1. Who we are

Neotelix provides threat detection, intelligence and response tooling for organisations. This policy explains how we handle personal information when you visit this website, contact us, or use the service.

For any privacy question or request, contact Meherzad Javed at meherzad.javed@neotelix.com.

2. This website

This site loads no third party scripts and sets no tracking cookies. There is no analytics product, no tag manager and no advertising pixel on any page. Nothing follows you from here to anywhere else, and we hold no record of your visit beyond the ordinary server logs our hosting provider keeps to run the service.

If you use the demo request form, it collects four things: your name, your work email address, your organisation and whatever you choose to write in the message. Those are emailed to a single mailbox read by one person. The form stores nothing. There is no database behind it, no mailing list, and no newsletter.

3. The product

Signing in to the console sets one session cookie. It is marked so that scripts on the page cannot read it and so that it is not sent on requests coming from other sites. Your interface preferences, such as which tab you had open, are kept in your own browser and never sent to us.

Account information we hold is the minimum to run the service: a name, a work email address, the organisation, the role assigned, and the record of authentication and support correspondence.

4. What happens to an incident you submit

When your team submits an alert for analysis, the submission carries alert fields, observables such as file hashes, domains, addresses and URLs, any MITRE ATT&CK techniques your SIEM has tagged, and whatever context you choose to include.

We strip identifiers out of that submission before anything else happens to it. Specifically, and automatically:

• Anything shaped like an email address, or like a Windows account in DOMAIN\\user form, is discarded entirely. It is not analysed, not stored and not sent anywhere.
• A file path sitting under a user's home directory is reduced to the bare filename, so the filename is analysed and the person's name in the path is not.
• Every value is length limited before it is used, and a submission is capped at 200 observables.
• The response tells you how many values were discarded, so the stripping is visible to you rather than silent.

What reaches us in the first place is set by the connector configuration rather than by a choice your analysts make each time. We supply the connector, we write the queries it runs, and we install and configure it with you, so we will tell you what it collects before it runs and we will adjust it to exclude anything that must not leave your environment. You can change that configuration or switch the connector off at any time.

Where your own correlation searches decide which incidents reach us, the rows they produce are what we receive, so keep personal information and secrets out of them where you reasonably can.

5. Artificial intelligence, and what is sent where

Guidance is generated by a third party AI provider, and the stripped incident context is sent to it. We use OpenAI for this. We are telling you plainly because it is the part of the service that sends your material outside our own infrastructure, and you are entitled to know before you submit anything.

What travels is the sanitised observables described above, the technique identifiers, and the public threat intelligence our own knowledge base holds about those techniques. Raw log lines, uploaded file contents and your hostnames and usernames are not part of a prompt.

What comes back is the analysis: a verdict, the intelligence that matched, the evidence behind it, and step by step investigation and response guidance. Where you have told us which SIEM you run, the guidance carries queries written in that product's own language. Seven products are supported: Microsoft Sentinel, Splunk, Elastic, QRadar, Google SecOps, LogRhythm and Sumo Logic.

Neotelix does not act in your environment. It does not contain, remediate, isolate or change anything. It proposes, and your analysts decide. Guidance that no human has reviewed is labelled as such wherever it appears.

6. Who does what with the data

For the incident material your organisation submits, your organisation decides what is submitted and why, and we process it to provide the service you have contracted. For your account and your correspondence with us, we decide how that information is handled. Exactly how those roles are named depends on the law that applies to you and on the terms we have agreed.

You are responsible for having the rights and internal notices needed to submit incident material to us.

7. Where it is processed, and who else is involved

The service runs on Microsoft Azure in the East US 2 region, and that is where your data is held. The AI provider described above processes in the United States. Email reaches us through an email provider. Those three are the parties involved in delivering the service, and we do not sell, rent or share your information with anyone for advertising or any other purpose.

Inside Neotelix, access is limited to the people who need it to run the service or answer your support requests.

If you are outside the United States, submitting to us involves an international transfer. Contact us for the safeguards that apply to you.

8. The record of who did what

The service keeps an audit trail of the actions taken in it, and that includes reads as well as changes, because the question an organisation eventually asks is who looked at a given customer's incidents. Each entry records the action, who took it and when. Those records are kept for 400 days.

A link to a completed analysis can be shared outside the console. That link is a credential: it expires, and it reaches exactly one analysis.

9. How long we keep things

Audit records are kept for 400 days, as above. Account information is kept while the account exists. Incident analyses are kept until you delete them, and you can delete an individual analysis from the console.

Two things deliberately survive a deletion, and you should know which. A report that has already been produced is immutable by design, because it is the record of what was done; and an entry in the response log stays, with its link to the deleted analysis cleared. Both exist so that a record of a human decision cannot be rewritten afterwards.

When an organisation leaves, its data is removed from both of our databases.

10. Your rights

Depending on where you live, you may have the right to ask for a copy of your personal information, to have it corrected or deleted, to restrict or object to how it is used, or to receive it in a portable form. You may also complain to your data protection regulator.

Write to meherzad.javed@neotelix.com and we will act on it. The service has the means to export an organisation's data and to erase it, so this is a request we can carry out rather than only acknowledge. We may need to confirm who you are, and where the information was submitted by an organisation rather than by you, we will need to involve that organisation. Timescales vary by jurisdiction.

11. Security

Each organisation's data is separated inside the database itself rather than only by application code, so a query cannot reach another organisation's records even if the application is wrong. Access needs either an API key or a signed in session, never both at once. The database is not reachable from the public internet.

There is more detail on our security page.

12. Children

The service is built for organisational security teams. It is not intended for or directed at children.

13. Changes

We will update this policy when our practices, the service or our legal obligations change, and the date at the top will say when. Where a change is material we will say so on the website or in the service.

This policy describes privacy practices. Terms governing use of the service, including restrictions on reverse engineering, are set out separately in the agreement with your organisation.