Privacy Policy

1. Who We Are

The AegisWire platform is operated by AegisWire, Inc., a corporation incorporated in Delaware, USA. Development, support and operations are provided by ITLOX LTD (registered in England and Wales, company number 16587309), which is the contracting entity and the data processor named in our Data Processing Addendum. In this policy “AegisWire”, “we”, “us” and “our” refer to those entities together. We are a business-to-business (“B2B”) software and infrastructure company providing a post-quantum secure transport and enterprise VPN platform, with optional separately-licensed add-on capabilities. We are not a consumer business.

For data protection purposes, AegisWire acts as a data controller in relation to personal data collected through our website and marketing activities. For personal data processed within the platform on behalf of enterprise customers, AegisWire acts as a data processor — see our Data Processing Addendum.

Our primary contact for data protection matters is: legal@aegiswire.com

2. Data We Collect and Why

2.1 Website and Enquiry Data

When you visit our website or submit an enquiry, we collect:

2.2 Platform and Technical Data (Processor Role)

When enterprise customers deploy the AegisWire platform, we process technical data (such as session metadata, policy logs, signed enrolment records, and cryptographic handshake records) on their behalf as a data processor. By design, the platform’s post-quantum secure transport encrypts customer traffic end-to-end, and our operational telemetry is privacy-preserving — we do not have access to the plaintext contents of tunnelled traffic. This processing is governed by our Data Processing Addendum and the applicable customer contract, not this Privacy Policy.

2.3 Website Analytics and Cookies

When you accept statistics cookies, Google Analytics 4 collects information about visits to our public marketing website, including page views, browser and device information, and pseudonymous cookie identifiers. Google receives connection information, including your IP address when your browser contacts its service. We use the resulting reports to understand and improve the website. We do not load this tag before statistics consent or in the customer portal, staff console or VPN Control Plane. Our tag disables Google Signals and advertising personalisation and omits query strings and URL fragments from the page and referrer URLs it configures.

We use cookies and similar technologies as described in our Cookie Policy.

2.4 Data We Do Not Collect

We do not knowingly collect data from children under 16. We do not sell, rent, or broker personal data to third parties. We do not use personal data collected through the website for profiling or automated decision-making that produces legal or similarly significant effects.

3. How We Use Personal Data

We use personal data collected through the website to:

• Respond to enquiries, demo requests, and sales conversations.
• Send transactional communications about your request or account.
• Send product and marketing updates where you have provided consent or where we have a legitimate interest and you have not opted out.
• Comply with legal and regulatory obligations.
• Detect, investigate, and prevent fraud, abuse, and security incidents.
• Improve and develop our website and services.

We do not use your personal data for purposes incompatible with those stated above without your consent or a lawful basis under applicable law.

4. Lawful Basis for Processing (GDPR / UK GDPR)

Where GDPR or UK GDPR applies, we rely on the following lawful bases:

• Legitimate interests: Processing enquiry data and website security information to operate our business, where those interests are not overridden by your data protection rights.
• Consent: Optional website analytics and marketing communications you expressly choose. Change or withdraw analytics consent through Cookie preferences in the footer; withdraw marketing communications consent by emailing legal@aegiswire.com.
• Contract: Where processing is necessary to take pre-contractual steps or to perform a contract with you or your organisation.
• Legal obligation: Where processing is required to comply with applicable law.

5. Data Sharing and Third Parties

We do not sell your personal data. We share data only as follows:

5.1 Service Providers (Processors)

We engage the following categories of service provider who process personal data on our behalf:

• Cloud infrastructure: Microsoft Corporation (Microsoft Azure), used for the AegisWire services we operate — the website and documentation site, the customer portal, licensing and entitlements, billing, and the release catalogue — together with their database, private networking, DNS and key management. Your own Control Plane and Gateways run in infrastructure you choose and control; the providers you use for them are your providers, not ours. See our Sub-Processors page for the full list and locations.
• Email delivery: Azure Communication Services for transactional email (password reset, verification, invitations), and Microsoft 365 for inbound business mail.
• Payments: Stripe, Inc., on Stripe’s own infrastructure.
• Release signing and distribution: Amazon Web Services, Inc. — AWS Key Management Service holds the signing keys for AegisWire release artifacts and AWS S3 distributes them. This handles build outputs only and involves no personal data.
• Website analytics: Google Analytics, only after statistics consent. See Google’s explanation of data use on partner sites and our Cookie Policy.

All processors are contractually bound by data processing terms requiring adequate security and prohibiting use of data for their own purposes.

5.2 Legal and Regulatory Disclosures

We may disclose personal data where required by law, court order, regulatory authority, or to protect the legal rights, property, or safety of AegisWire, our customers, or the public.

5.3 Corporate Transactions

In the event of a merger, acquisition, or sale of all or substantially all of our assets, personal data may be transferred to the successor entity, subject to equivalent privacy protections. We will notify you of any such change where required by law.

6. International Data Transfers

The AegisWire services we operate — the website and documentation site, the customer portal, licensing and entitlements, and billing — are hosted on Microsoft Azure in Ireland (North Europe), and the platform database holding account and billing records runs there. That is the only region these services run in, and they are not hosted in the United States.

Your own deployment is not ours to place. Your Control Plane and your Gateways run in infrastructure you own, in the regions you choose, which is what makes data residency yours to determine rather than ours. A customer who places a Gateway outside the UK or EEA is choosing that placement for their own tunnelled traffic; the infrastructure provider supplies compute and network only and has no access to the plaintext of tunnelled traffic.

Optional Google Analytics processing is separate from our Azure hosting and may take place outside the UK and EEA, including in the United States. Google describes its safeguards in its data processing terms. Two other group functions involve the United States. Payment processing is performed by Stripe, Inc. on Stripe’s own infrastructure. Release artifacts are signed and distributed using AWS services in us-east-1 — that process handles build outputs only and involves no customer personal data.

Where personal data is transferred from the European Economic Area (EEA) or the United Kingdom to a country that is not subject to an adequacy decision, we rely on appropriate safeguards including:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• The UK International Data Transfer Addendum where applicable.
• Our infrastructure providers’ participation in certified transfer frameworks where applicable.

You may request a copy of our transfer safeguards by contacting legal@aegiswire.com.

7. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, unless a longer period is required by law:

• Enquiry and contact data: up to 3 years from the date of last meaningful interaction, unless you request earlier deletion.
• Marketing consent records: for the duration of your consent plus a reasonable period for legal compliance.
• Contractual and billing data: for the duration of the contract plus the period required by applicable law (typically 6–7 years for financial records).
• Security and fraud logs: up to 12 months unless a longer period is required for an ongoing investigation.
• Analytics cookies: configured for up to 180 days without automatic extension on page views. Google Analytics data retention is managed separately in the Analytics property; contact legal@aegiswire.com for details or a deletion request. Withdrawing consent stops future collection and does not automatically delete previously collected data.

8. Your Rights

8.1 Rights Under GDPR and UK GDPR

If you are located in the EEA, the United Kingdom, or Switzerland, you have the following rights in relation to your personal data:

• Right of access: to obtain a copy of the personal data we hold about you.
• Right to rectification: to correct inaccurate or incomplete personal data.
• Right to erasure (“right to be forgotten”): to request deletion of your personal data where there is no compelling reason to continue processing it.
• Right to restriction of processing: to ask us to pause processing of your data in certain circumstances.
• Right to data portability: to receive your personal data in a structured, machine-readable format.
• Right to object: to object to processing based on legitimate interests or for direct marketing at any time.
• Rights related to automated decision-making: we do not make solely automated decisions with legal or significant effects, but you have the right to request human review if you believe otherwise.

To exercise any of these rights, contact legal@aegiswire.com. We will respond within one calendar month. We may need to verify your identity before processing a request.

If you are not satisfied with our response, you have the right to lodge a complaint with the relevant supervisory authority. In the UK, this is the Information Commissioner’s Office (ico.org.uk). In the EEA, contact your national data protection authority.

8.2 US State Privacy Rights

AegisWire is a B2B platform and does not sell personal data. Residents of US states with applicable privacy laws (including California CCPA/CPRA, Virginia VCDPA, Colorado CPA, and others) may have rights to know, delete, opt-out of sale (we do not sell), and non-discrimination. To make a request, contact legal@aegiswire.com.

9. Security

AegisWire implements technical and organisational measures to protect personal data, including post-quantum secure transport for platform traffic (hybrid ML-KEM-1024 with X25519 key exchange, ML-DSA-87 identity signatures, and AES-256-GCM record encryption — aligned with the US NSA CNSA 2.0 suite), encryption in transit, signed and verified software distribution, fail-closed access controls, and security monitoring. Our control posture is built to the controls that SOC 2, ISO 27001, GDPR, UK GDPR, and HIPAA-style reviews examine. Details are set out in our Security & Trust Centre.

However, no method of transmission over the internet is completely secure. We cannot guarantee absolute security and you transmit data at your own risk. Where we become aware of a personal data breach, we will comply with our notification obligations under applicable law.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email or by prominent notice on our website before they take effect. The “Last updated” date at the top reflects the most recent revision. Your continued use of the website or platform after the effective date constitutes acknowledgement of the updated policy.

11. Contact Us

For any privacy-related queries, data subject requests, or to report a concern: