Privacy Policy

1.1 Policy Application: This Privacy Policy ("Policy") governs the collection, processing, transmission, storage, and permanent erasure of information handled by Fortica Cyberguard LLP ("Fortica", "we", "us", or "our"). This Policy applies to all individuals accessing our website (forticacyber.com), prospective clients submitting assessment inquiries, and authorized enterprise client organizations engaging Fortica for cybersecurity auditing, penetration testing, red teaming, and code review services.

1.2 Operational Identity: Fortica Cyberguard LLP is an offensive cybersecurity consulting firm legally incorporated in Ahmedabad, Gujarat, India, dedicated to high-assurance vulnerability research, adversarial emulation, and DevSecOps engineering.

2.1 Consultation & Scoping Inquiries

When an organization or individual requests an assessment or contacts Fortica via our digital forms, we collect: full name, authorized corporate email address, corporate telephone number, organization name, approximate technical infrastructure scope (e.g., number of IP targets, repository counts), and mutual Non-Disclosure Agreement (NDA) requirements. This data is utilized solely to facilitate scoping conversations and contract execution.

2.2 Technical Audit Telemetry & Artifacts

During active authorized security engagements (such as Web/API VAPT, Mobile Security Testing, Cloud Infrastructure Assessments, or Source Code Reviews), Fortica engineers may temporarily generate or receive technical telemetry, including: target IP addresses, API schemas, server response headers, network packet traces, and sanitized vulnerability reproduction proofs-of-concept (PoCs).

2.3 Diagnostic & Log Data

Our web infrastructure automatically records standard HTTP access logs consisting of: originating IP address, user-agent string, operating system version, referral headers, and timestamp. This data is processed strictly for security monitoring, web performance optimization, and malicious traffic mitigation.

3.1 Code & Credential Purging: All customer source code provided for static code analysis or white-box penetration testing is hosted exclusively on volatile, memory-isolated local assessment machines. No client code is ever uploaded to public AI models, external SaaS parsers, or third-party cloud analytics.

3.2 Four-Phase Lifecycle: Upon final delivery of the vulnerability assessment deliverable and completion of the remediation retesting window, all client test data undergoes cryptographic erasure conforming to DoD 5220.22-M / NIST SP 800-88 Rev. 1 Guidelines for Media Sanitization within fourteen (14) calendar days.

Fortica enforces multi-layered technical, cryptographic, and operational safeguards to protect client confidential records:

• Encryption at Rest: All assessment reports, vulnerability databases, and client engagement communications are encrypted using AES-256 GCM authenticated encryption.
• Encryption in Transit: All data transmissions between client endpoints and Fortica systems enforce TLS 1.3 cryptographic suites with strict Perfect Forward Secrecy (PFS).
• Hardware-Enforced Isolation: Lead assessment engineers utilize FIPS 140-2 Level 2 validated hardware security keys (FIDO2/WebAuthn) and hardware-encrypted NVMe storage.
• Principle of Least Privilege (PoLP): Engagement materials are strictly restricted to assigned lead auditors; cross-team access is blocked via role-based access control (RBAC).

Fortica processes data exclusively under verified lawful grounds recognized under the Digital Personal Data Protection (DPDP) Act 2023 (India) and Article 6 of the General Data Protection Regulation (GDPR):

• Contractual Performance: Processing necessary to fulfill cybersecurity assessment agreements, Statements of Work (SOW), and non-disclosure covenants.
• Explicit Consent: Clear affirmative action provided when submitting inquiry forms or subscribing to research briefs.
• Legitimate Interests: Conducting offensive threat analysis and maintaining system integrity against cyber attacks without overriding individual fundamental privacy rights.
• Legal Obligation: Compliance with applicable Indian statutory accounting and cybersecurity notification directives.

6.1 Zero Data Monetization: Fortica has never sold, licensed, rented, or monetized client data or assessment telemetry, and will never do so under any circumstances.

6.2 Restricted Service Providers: We engage only enterprise-grade infrastructure providers (such as encrypted hosting facilities and SOC 2 certified email carriers) who act strictly as Data Processors bound by written Data Processing Agreements (DPAs) with confidentiality obligations equal to or exceeding this Policy.

6.3 Compelled Legal Disclosures: We will not disclose client vulnerability data or telemetry to regulatory or law enforcement bodies unless compelled by a valid court order issued by a court of competent jurisdiction in India, and where legally permissible, will provide prompt written notification to the client prior to disclosure.

Regardless of geographic jurisdiction, Fortica extends comprehensive data autonomy rights to all website visitors and engagement contacts:

• Right to Access: Request confirmation and digital copies of personal data maintained within our systems.
• Right to Rectification: Request prompt correction of inaccurate or outdated contact information.
• Right to Erasure ("Right to be Forgotten"): Request immediate permanent deletion of all non-statutory records and marketing contacts.
• Right to Restrict Processing: Limit the scope of data utilization during scoping discussions.
• Right to Withdraw Consent: Revoke consent at any time without retroactive impact on prior lawful processing.

As offensive security engineers, Fortica maintains an emergency Computer Security Incident Response Team (CSIRT). In the improbable event of a security incident impacting client metadata or engagement communications:

• 24-Hour Initial Notice: We will notify the affected client organization's designated security contact in writing within twenty-four (24) hours of confirmed incident verification.
• Comprehensive RCA: Within seventy-two (72) hours, Fortica will furnish a detailed Root Cause Analysis (RCA), complete forensics timeline, and technical mitigation ledger.

Enterprise clients may formalize data purging upon the conclusion of any penetration testing, code review, or compliance engagement. Upon request, our Principal Security Architect executes a cryptographically hashed Certificate of Data Destruction attesting that all temporary credentials, local repository branches, testing databases, and raw fuzzing logs have been permanently purged.

For inquiries regarding this Policy, to exercise your legal data rights, or to report privacy concerns, please contact our appointed Data Protection Officer: