SecureGraph Privacy Policy

1. Who is responsible for your data

Phantix Labs Ltd, Nigeria (“Phantix Labs”, “we”), is the data controller for the personal data described in this policy. We are registered with the Nigeria Data Protection Commission (NDPC) and have appointed a Data Protection Officer, reachable at [email protected]. If you use SecureGraph on behalf of your employer or another organization, that organization decides why the platform is used and we act as its processor for the data it puts in; this policy describes what we do as controller for account, billing and platform data.

2. What this policy covers

This policy covers the SecureGraph websites (phantixlabs.com), the operator platform (app, attack, defend, code and staff portals), our documentation, the connector and agent software, support and email communications. It does not cover third-party sites we link to, and it does not cover your own systems — we describe those separately in section 4.

3. Personal data we collect

We collect the minimum needed to run a security platform, and we collect it from you, from your device, and from the people you invite to your organization.

• Account and identity: name, work email, password hash, organization name, role, time zone, and sign-in metadata (device id, IP, user agent, session timestamps).
• Verification: email and phone one-time codes, domain-ownership proofs (DNS TXT or well-known file), and optional CAC/RC company registration details if you supply them.
• Billing: plan, invoices, payment status and the reference ids our payment processor returns. Card details are entered with the processor directly; we never see or store full card numbers.
• Product usage: pages and modules used, feature toggles, error and performance telemetry, and audit logs of privileged actions (approvals, promotions, exports, delegations).
• Security-testing records: scope definitions and rules of engagement, consent and authorization confirmations, scan metadata, finding descriptions and evidence our agents or staff produce, and the reports generated from them.
• AI assistant: the prompts and instructions you send to the agent, the tool output it observes, and its transcript. Redaction and scope limits apply, and you can see the full transcript.
• Support and communications: messages you send us, attachment metadata, feedback and satisfaction responses.

4. What stays out of SecureGraph

Your production business data is not ours to hold. Security inventory — assets, findings, evidence, scan results and reports — is written to a dedicated security database that belongs to your organization, not to the shared control plane. We do not copy your application databases, do not read customer records to detect vulnerabilities, and do not write any inventory into your production systems. Where a connector runs in your network, it holds credentials in your environment and forwards only the security metadata needed for the job you authorized. Request and response excerpts appear in evidence only when a test produced them, and they are visible to your own organization.

5. Why we are allowed to process it (lawful bases)

Under section 25 of the NDPA we rely on the following bases, and we identify the basis for each purpose when we describe it below.

• Contract: creating your tenant, delivering the platform and the security services you ordered, billing, and support.
• Legal obligation: tax and company records, security-incident records, and lawful requests from a competent authority.
• Legitimate interests: keeping the platform secure and available, preventing abuse and fraud, improving the product through aggregated usage analysis, and communicating service changes — balanced against your rights.
• Consent: optional marketing email, optional analytics cookies, and any special-category data you choose to share with us. You may withdraw consent at any time.

6. How we use personal data

• Provide, operate and secure the platform, including authenticating you, enforcing your scope and authorization rules, and preventing misuse.
• Perform the discovery, scanning, assessment and reporting you request, and let staff deliver assessment services under your rules of engagement.
• Bill you, manage subscriptions, credits, coupons and invoices, and recover amounts owed.
• Send service messages: verification codes, security alerts, findings notifications you subscribed to, and material changes to terms or this policy.
• Support you, investigate incidents, and maintain audit trails required for our ISO 27001 and NDPA obligations.
• Improve the product using aggregated, de-identified usage data; we do not use your security findings to train models for other customers.

7. Who we share it with

We do not sell personal data. We share it with service providers who process it on our instructions under contract, and only as far as needed for the purpose described.

• Hosting and infrastructure providers that run our servers, object storage and backups.
• Payment processing for card and transfer payments; the processor is the controller of the card data you enter with it.
• Email delivery for verification, alerts and reports.
• Model providers that power the AI agent and the fix assistant: the prompts, tool output and finding context needed for the request are sent to the provider to generate a response, under terms that prohibit training on our data.
• Professional advisers, auditors and insurers where necessary, and a successor entity in a merger or acquisition, subject to this policy.
• Authorities where we are legally required, or where disclosure is needed to investigate an attack on the platform or to protect someone's safety.
• MSSP partners and delegates your organization itself appoints; a partner sees only what your organization grants, and every delegation is scoped, logged and revocable.

8. International transfers

Our primary platform data is hosted in the European Union and the Nigerian region we operate from, and some providers process data outside Nigeria. Where personal data leaves Nigeria we rely on section 41–42 of the NDPA: an adequacy decision, or appropriate safeguards such as the standard contractual clauses with a transfer impact assessment. You can ask the DPO for a copy of the safeguards that apply to your tenant.

9. How long we keep it

• Account and organization records: while your tenant is open, then as long as needed for the agreement and any statutory retention duty.
• Security-testing records and reports: for the retention period your organization configures, subject to the platform's minimum and maximum, so audit evidence stays available when you need it.
• Agent transcripts and AI assistant context: for the operational window shown in the console, then purged or archived with the session.
• Billing and tax records: for the period Nigerian law requires.
• Audit, security and access logs: for the period needed to investigate incidents and demonstrate compliance.
• Marketing preferences and consent records: until you withdraw consent, plus a record of the withdrawal.

10. How we protect it

SecureGraph is built by a security company and is expected to meet the standard we sell: encryption in transit and at rest, least-privilege access with dual control for high-impact actions, tenant isolation between organizations, immutable audit trails, tested backups, dependency and code review, and periodic penetration testing of the platform itself. No system is perfect; if a breach affects your personal data we will notify you and the NDPC within the timelines the NDPA and the NDPC guidance set.

11. Your rights

Under sections 34–37 of the NDPA you can ask to access your personal data, correct it, delete it, restrict or object to processing, withdraw consent, and receive a copy in a portable format. You can make a request in the product (Settings → Privacy → Data subject request) or by emailing the DPO. We verify your identity before acting and answer within the statutory period. If you are not satisfied, you may complain to the Nigeria Data Protection Commission. Where your organization is the controller of the data, we forward the request to it and support it in responding.

12. Cookies and analytics

The platform uses strictly necessary cookies for sign-in, session security and load balancing — these cannot be turned off without breaking your session. Public pages and the operator apps may use first-party analytics to understand feature use; that analytics is optional and respects your consent choice. We do not use advertising cookies or third-party trackers across other sites.

13. Children

SecureGraph is a business product. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us personal data, contact the DPO and we will delete it.

14. Changes to this policy

This policy is versioned. When we make a material change we publish the new version with its effective date and tell account owners by email before it takes effect; where the change affects how we rely on your data, we ask for acceptance in the product. Earlier versions are available from the DPO on request.

15. Contact us

Data Protection Officer, Phantix Labs Ltd: [email protected], or the contact form on phantixlabs.com. Report security issues in the platform itself to [email protected]. Our registered postal address is available on request, and the DPO answers data protection questions within the NDPA response window.