This Privacy Policy describes how Noct, LLC collects, uses, stores, protects, and discloses information obtained through our website located at https://noct.gg, our security scanning platform, dashboards, APIs, alerts, reports, and related services or communications.

This Privacy Policy is intended to explain our data practices. Your use of the Services may also be governed by our Terms of Service, subscription terms, order forms, or other applicable agreements.

1. Information We Collect

When you create an account, register for the Services, purchase paid Services, submit assets, initiate scans, interact with dashboards or APIs, or communicate with us, we may collect account information, billing and subscription information, Target Data, Scan Results, AI-assisted summaries, usage data, technical data, communications, support data, cookies, and Platform Operations Metadata.

2. Target Data

To perform security scanning, you may provide information about servers, IP addresses, hostnames, domains, subdomains, applications, cloud assets, endpoints, or other infrastructure assets that you represent you are authorized to scan. We treat Target Data as confidential customer data.

3. Scan Results, Alerts, and Reports

We generate and store data resulting from authorized scans of your submitted assets, including detected services, open ports, software version information, configuration details, security alerts, risk indicators, vulnerability information, remediation context, alert status, timestamps, and related metadata. Scan Results are associated with your account and treated as confidential customer data.

4. Platform Operations Metadata

To operate the Services, NOCT collects, generates, and stores Platform Operations Metadata related to customer accounts, assets, scans, reports, subscriptions, authorization confirmations, billing tiers, and platform activity.

Platform Operations Metadata may include asset identifiers, asset labels, asset type, IP addresses, domains, hostnames, ports, scan configuration, scan status, scan timestamps, scan frequency, report identifiers, alert identifiers, dashboard activity, user actions, API activity, authorization confirmations, subscription limits, asset counts, billing tier metadata, and related operational metadata.

NOCT uses Platform Operations Metadata to provide the dashboard, manage asset inventory, schedule and execute scans, associate Scan Results with customer accounts, generate reports, enforce subscription and asset limits, maintain audit logs, prevent abuse, investigate unauthorized scanning, secure the Services, and comply with legal obligations.

Security Framework Alignment

NOCT is designed with reference to commonly recognized security frameworks and industry practices, including SOC 2 Trust Service Criteria, ISO/IEC 27001 security principles, NIST cybersecurity guidance, and generally accepted industry security controls.

NOCT uses these frameworks as guidance for developing security controls, access practices, data handling practices, monitoring, incident response, and risk management.

Unless expressly stated in a signed agreement or published audit/certification report, NOCT does not represent that it is SOC 2 certified, ISO/IEC 27001 certified, or formally certified by NIST.

AI Security

NOCT AI-assisted systems are operated on NOCT-controlled infrastructure and are not provided by third-party AI providers unless expressly disclosed in a written customer agreement or updated policy.

NOCT does not use Customer Target Data, Scan Results, alerts, AI inputs, or AI-generated summaries to train generalized machine learning models.

AI-assisted processing is designed to be stateless during generation. Generated summaries may be stored only as part of the related alert, report, or customer account record where needed to provide the Services.

Where technically feasible, AI-assisted processing is designed to minimize or exclude direct asset identifiers, such as IP addresses, domains, hostnames, and similar infrastructure identifiers, unless technically necessary to generate the requested summary.

5. How We Use Information

We use information to provision, operate, maintain, secure, and improve the Services; create and manage accounts; authenticate users; perform authorized scans; generate and display Scan Results, alerts, findings, and reports; provide dashboards, notifications, APIs, and security insights; process payments; communicate with you; monitor performance and security; prevent abuse; enforce agreements; comply with law; and protect NOCT, customers, users, and third parties.

We do not sell your Target Data or Scan Results. We do not use your Target Data, Scan Results, alerts, AI summary inputs, or AI-generated summaries to train generalized machine learning models, develop competing products, or create generalized datasets unrelated to providing the Services to you.

6. Authorized Scanning and Customer Responsibility

The Services are intended to be used only for security scanning of assets that you own, control, administer, or are otherwise legally authorized to test. By submitting Target Data or initiating scans, you represent that you have all necessary rights, permissions, and authority to scan those assets and to provide related data to NOCT.

7. Data Storage and Security

Customer security data, including Target Data, Scan Results, alerts, reports, AI summary inputs, and AI-generated summaries, is stored and processed within the United States on NOCT-controlled systems, except as otherwise stated in a written customer agreement.

Data transmitted to and from the Services is encrypted in transit using TLS or comparable encryption protocols. Data stored on NOCT-controlled systems is encrypted at rest using industry-standard encryption controls where technically feasible and appropriate.

Where technically feasible, credentials and sensitive values are decrypted only in memory for the duration of authorized scan execution and are not persisted in plaintext.

8. Operational Vendors

NOCT may use limited third-party service providers for operational business functions, including billing, email, customer support, traffic protection, CDN/proxy services, firewall services, anti-abuse services, and basic request logging. These providers may process limited account, billing, support, usage, traffic, request, device, or technical data as necessary to provide those services.

9. Data Retention

We retain information for as long as reasonably necessary to provide the Services, maintain your account, comply with legal obligations, resolve disputes, enforce agreements, prevent abuse, and protect the security of the Services.

We retain Target Data, Scan Results, alerts, findings, reports, and related AI-generated summaries while your account is active. If you terminate your account, we will delete or anonymize Target Data and Scan Results within 90 days of account closure, unless retention is required by law, security obligations, backup processes, dispute resolution, fraud prevention, or enforcement of agreements.

10. Sharing and Disclosure

We do not sell, rent, or trade your personal information, Target Data, or Scan Results to third parties. We may share information with limited service providers, as directed by you, in business transfers, to comply with law, to enforce agreements, to investigate abuse, to prevent unauthorized scanning, to address security incidents, or to protect NOCT, customers, users, and third parties.

11. Your Rights and Choices

Depending on your jurisdiction, you may have rights to access, correct, delete, export, restrict, or object to certain processing of personal data. To exercise rights, contact [email protected]. We may require information to verify your identity and authority before processing a request.

12. California Privacy Rights

If you are a California resident, you may have additional rights under California privacy law. We do not sell personal information and do not share personal information for cross-context behavioral advertising as those terms are defined under California privacy law.

13. Children's Privacy

The Services are intended for business use by individuals who are at least 18 years old. We do not knowingly collect personal information from individuals under 18.

14. Third-Party Links and Services

The Services may contain links to third-party websites, documentation, integrations, or services. We are not responsible for the privacy or security practices of third-party services.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we may notify you by email, through the Services, or by posting a prominent notice as required by law.

16. Contact

Noct, LLC | [email protected] | https://noct.gg