Privacy Notice

PostureIQ is operated by Gold Tree Group LLC, 2044 Lovell Pl, Santa Clara, CA 95051. Privacy questions and requests: privacy@postureiq.io.

Who this notice is for#

PostureIQ is a business platform used by organisations to assess their own security posture and the security of their vendors. Three groups of people have data in the system.

Our customers' users are people at an organisation that subscribes to PostureIQ, who sign in and use the platform.

Vendors are people at a third-party company that one of our customers has asked to complete a security questionnaire. They receive an invitation by email and use a vendor portal without creating a PostureIQ account.

Visitors are people who visit our website without signing in.

For customer and vendor data, our customer decides what is collected and why. We process that data on their instructions. For our own website and account administration, we decide, and this notice describes what we do.

What we collect#

From our customers' users: name, work email address, organisation, role, and the content they enter, including assessments, vendor records, notes and uploaded documents. We also record sign-in times and actions taken in the platform.

From vendors: the contact name and email address our customer provides, the answers given in the questionnaire, documents uploaded in response, and portal access times.

From visitors: IP address, browser and device information, pages visited and referring site, through Google Analytics on our marketing pages only. Analytics is not active inside the PostureIQ application.

Automatically, for everyone using the platform: IP address, request logs, and error reports when something fails.

We do not collect special categories of personal data, and we ask customers not to enter them. Vendor questionnaires are about security controls, not individuals.

Why we process it#

To provide the platform: running assessments, sending questionnaires, scoring vendors, generating reports, and keeping accounts secure. To support customers when they contact us. To bill subscriptions. To detect and investigate security incidents and misuse. To improve reliability through error monitoring.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

Who we share it with#

We use third-party providers to run the service. Each is listed, with what it receives, on our subprocessor list. In summary: infrastructure and hosting, email delivery, AI analysis, billing, error monitoring, and the public security data sources we query to screen vendors.

We do not share customer or vendor data with anyone else, except where a customer directs us to, for example by connecting PostureIQ to their Microsoft 365, Coupa, Slack or Teams, or where the law requires it.

Sanctions and security screening#

To screen vendors, PostureIQ sends vendor company names and vendor contact names to sanctions screening services, and vendor domain names and IP addresses to security data sources. This is a core function of the product and customers use it deliberately. The sources are named on our subprocessor list.

AI processing#

PostureIQ uses Anthropic's Claude to analyse documents, draft reports and suggest assessment answers. Content sent for analysis can include vendor questionnaire responses, uploaded document text, vendor contact details and scan findings.

Anthropic retains this content for up to 30 days and does not use it to train models.

AI output can be wrong or incomplete. It is reviewed by the customer before it is relied upon.

How long we keep it#

When data is deleted, it is removed from the live system and from backups within 7 days.

Our security audit records are an exception. So that changes to customer records can be traced, these records keep the identifier of a deleted record, a short description such as a title or company name, and a one-way fingerprint of its contents. They do not keep the contents themselves, and they are retained for 24 months.

A customer may delete their own data at any time from within the platform, and may ask us to delete their account by writing to privacy@postureiq.io.

Where data is held#

PostureIQ is hosted in the United States. Our providers' primary processing is in the United States, though some may process data in other countries as part of their global operations. Each provider's location is listed on our subprocessor list.

Security#

Data is encrypted in transit and at rest.

Each customer organisation's data is kept separate. Every request to the platform is restricted to the organisation the signed-in user belongs to, and this separation is enforced by the application on every read and write.

Administrative access to production systems is restricted and protected by multi-factor authentication. Changes to customer records are recorded in an audit trail that cannot be edited or deleted through the application.

Your rights#

Depending on where you live, you may have the right to know what personal information we hold about you, to receive a copy, to correct it, to delete it, and to be free from discrimination for exercising those rights. We do not sell personal information or share it for targeted advertising, so there is nothing to opt out of.

Write to privacy@postureiq.io. We will respond within 45 days, and will tell you if we need longer.

If you are a vendor#

The organisation that invited you decides what is collected and why. We will pass your request to them and help them answer it. You can also contact them directly.

Verification#

We will ask you to confirm your identity, usually by verifying control of the email address the request concerns.

Authorised agents#

You may use an agent, who must provide proof that you authorised them.

Children#

PostureIQ is a business product and is not directed at anyone under 18. We do not knowingly collect data from children.

Changes#

We will post changes here and update the date above. If a change materially affects how we handle personal data, we will notify customer administrators by email.

Contact#

Gold Tree Group LLC
2044 Lovell Pl, Santa Clara, CA 95051
privacy@postureiq.io