Cybereinforce is a cybersecurity company providing browser-native threat enforcement through its core product, Cybereinforce Threat Enforcement (CTE). CTE operates as a managed security layer deployed across enterprise endpoints, enforcing real-time URL filtering, threat intelligence blocking, and security event logging — directly within the browser.
This Privacy Policy applies to all data processed by Cybereinforce in the delivery of the CTE platform and related services. It governs the obligations of Cybereinforce as a data processor on behalf of its enterprise customers (the data controllers), and as a data controller where Cybereinforce independently determines the purpose of processing.
Cybereinforce processes the minimum data necessary to deliver browser-level security enforcement. We do not collect browsing content, personal communications, or any data beyond what is technically required for threat detection and audit functions.
| Data Type | Description | Classification |
|---|---|---|
| Admin Email | Used for account authentication and administrative notifications. Never used for marketing. | Required |
| Device Identifiers | Hostnames and internal device IDs used to associate security events with enrolled endpoints. No hardware fingerprinting. | Required |
| Blocked URL Metadata | The URL path and domain of blocked requests, threat category, and timestamp. No page content, no query parameters containing personal data, no session tokens. | Required |
| Security Event Logs | Structured logs of threat enforcement actions: block decisions, policy matches, and incident triggers. Used for SIEM export and audit trails. | Required |
| Tenant Configuration | Policy settings, integration credentials (encrypted), and deployment metadata configured by the admin. | Required |
| Integration Tokens | API tokens for SIEM integrations (e.g. Microsoft Sentinel, Defender). Stored encrypted, scoped to read/write operations only. | Optional |
| Platform Usage Metadata | Aggregate, anonymised usage signals (e.g. feature adoption rates) used to improve the platform. Not linked to individual users. | Anonymised |
Where applicable under the General Data Protection Regulation (GDPR), Cybereinforce processes personal data under the following lawful bases:
Data is never used for advertising, profiling, or any purpose unrelated to security enforcement. Cybereinforce does not build behavioural profiles of end users. All processing is scoped strictly to the delivery of the contracted security service.
Security event data generated by CTE remains under the control of the customer organisation. Customers may export their own security logs to external platforms including Microsoft Sentinel, Splunk, or other SIEM solutions of their choice — this is an explicit feature of the product, operated entirely at the customer's discretion.
Cybereinforce may engage limited sub-processors to operate infrastructure services (e.g. cloud hosting, database services). All sub-processors are bound by contractual data processing agreements and may not use customer data for any purpose outside of service delivery. A current list of sub-processors is available on request.
Where data is transferred outside the European Economic Area (EEA), Cybereinforce ensures adequate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission.
Upon contract termination, Cybereinforce will delete or return all customer data within 30 days upon written request. Customers may request earlier deletion at any time by contacting our data team.
Cybereinforce is, at its core, a security company. Protecting the data entrusted to us is treated with the same rigour we apply to protecting our customers' endpoints. We operate a security-first infrastructure model including:
Where Cybereinforce acts as a data processor, data subject rights requests (e.g. access, deletion) should be directed to your organisation's administrator, who acts as the data controller. Where Cybereinforce processes data as a controller (e.g. admin account data), the following rights apply:
To exercise any of these rights, contact us at info@cybereinforce.com. We will respond within 30 days.
The Cybereinforce administrative portal uses strictly necessary session cookies to maintain authenticated sessions. We do not use advertising cookies, third-party tracking pixels, or cross-site analytics on our platform.
| Cookie Name | Purpose | Type |
|---|---|---|
| cte_session | Maintains admin authentication state across requests. Expires on logout or after 8 hours of inactivity. | Necessary |
| cte_csrf | CSRF protection token. Prevents cross-site request forgery on authenticated endpoints. | Necessary |
| cte_locale | Stores the user's language and regional display preferences. | Functional |
For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact our privacy team. We are committed to responding within 30 days of receiving a request.
If you believe your data protection rights have been violated and we have not adequately addressed your concern, you have the right to lodge a complaint with your local supervisory authority. In the EU, this is the data protection authority of your member state. In the UK, this is the Information Commissioner's Office (ICO).