Privacy & trust
Privacy by design — because surveillance breaks the trust security depends on.
Secriiti is built to find security risk without becoming a surveillance tool. This page explains, in plain language, what we collect, what we refuse to collect, and the controls that keep it that way.
What we analyze
- Authentication and session events (success/failure, location, device class, timing)
- Access grants and changes (roles, scopes, entitlements)
- Resource access patterns (which systems, how often, when)
- Volume and movement signals (counts and sizes, not contents)
- Joiner / mover / leaver lifecycle events
What we never touch
- Message, email, or chat content
- Document, file, or attachment contents
- Keystrokes or screen recordings
- Secret per-individual risk scores
- Anything we'd sell, broker, or use to train shared models
Our principles
Five commitments we build inside.
1 · Metadata, not content
We detect risk from the shape of behavior — who, what, when, how much — never the words inside a message or file.
2 · Aggregate, don't surveil
Signals roll up to teams and roles. There is no covert dossier scoring each employee in the background.
3 · Transparency to the monitored
People can see what categories of metadata are analyzed about them. Monitoring you can't see isn't trustworthy.
4 · Data minimization
We collect the least required to produce a useful signal, and set sensible default retention windows.
5 · Your data stays yours
Customer metadata is never sold or shared, and is segregated per tenant with least-privilege internal access.
6 · Secure by default
Encryption in transit and at rest, with read-only, scoped connectors to the systems you choose to link.
Data lifecycle
Collection. Metadata is pulled through read-only, scoped API connectors to the identity, cloud, and SaaS systems you explicitly connect. There are no endpoint agents on employee devices.
Processing. Events are normalized and compared against role- and team-level behavioral baselines to surface meaningful deviations. Processing is designed to operate on metadata only.
Storage. Data is encrypted in transit and at rest and segregated by tenant. Secriiti is built to run on cloud infrastructure (Amazon Web Services), using managed, access-controlled services.
Retention. Signals and underlying metadata are retained for a configurable window so you can investigate trends, then expired. Enterprise plans can tailor retention and residency.
Deletion. You can disconnect a source or request deletion of your tenant data; disconnecting a connector stops further collection from that system.
This page describes our approach. For the formal terms governing data handling, see the Privacy Policy and Terms of Service.
Security that your team can stand behind.
If you can't explain your monitoring to the people being monitored, it's the wrong tool. Secriiti is designed so you can.