01Who we are
Tero provides cybersecurity monitoring and detection software for businesses. This Privacy Policy explains how we handle personal information when you visit our website, create an account, contact us or use our services.
In this policy, “Tero”, “we”, “us” and “our” refer to the operator of the Tero service. You can contact us about privacy at support@terosecurity.com.
02Our role and your organisation
We determine how personal information is used to operate our website, administer accounts, manage business relationships and protect our service. For these activities, we act as a data controller.
When we process personal information within customer security evidence on an organisation’s behalf, that organisation determines the purpose of the processing. Our handling of that information is governed by its instructions and the applicable service and data processing terms.
Information used to provide access to Tero, administer the service and communicate with you.
Recorded Decoy interactions processed to support your organisation’s detection and investigation activities.
If an organisation provides your account or controls the relevant security records, its privacy notice also applies. Requests about that organisation’s use of your information should be directed to it.
03Information we process
Account and authentication information
Your name, email address, organisation, account identifiers, roles and permissions, together with authentication activity needed to provide and secure access to your account.
Enquiries and communications
Contact details and information you provide when requesting a demo, asking about pricing, contacting support or otherwise communicating with us.
Subscription information
Subscription status, purchased Sensor allowances, billing contact details and payment-related records when you use paid service features. Payment providers also process information under their own privacy notices.
Service and Sensor information
Technical records such as IP addresses, request timestamps, service errors, software versions, Sensor identifiers, deployment configuration and health information used to operate and protect Tero.
Recorded Decoy interactions
Depending on the Decoy and interaction, security evidence can include source addresses, timestamps, protocols, authentication attempts, requests, commands, submitted content and measured outcomes. These records may contain personal information.
Optional website and application analytics
If you accept analytics, Google Analytics measures page visits, selected actions and successful enquiry submissions using sanitised page categories. It uses pseudonymous browser identifiers and processes technical browser and network information. We do not send account identifiers, form contents or customer security evidence.
04Why we use information
We use information to provide the service, respond to enquiries, administer subscriptions, support customers and protect our systems. Where data protection law requires a lawful basis, the basis depends on the purpose and circumstances.
| Purpose | Legal basis, where applicable |
|---|---|
| Provide accounts and subscriptions | Performing a contract with you or taking steps you request before entering a contract. Where you act for an organisation, our legitimate interests in administering that business relationship. |
| Respond and provide support | Performing our service commitments or our legitimate interests in responding to enquiries and supporting users. |
| Operate and secure Tero | Our legitimate interests in maintaining a reliable service, preventing misuse and protecting accounts and systems, balanced against individual rights. |
| Meet legal requirements | Compliance with applicable legal obligations, including required business records and valid legal requests. |
| Consent-based activities | Your consent where it is required. You may withdraw consent without affecting the lawfulness of processing carried out before withdrawal. |
Customer-directed processing of security evidence is governed by our role as a service provider and the customer’s instructions. The customer is responsible for establishing its legal basis for that processing.
Information needed for account access, subscription administration or requested support may be necessary to provide those functions. If it is not provided, we may be unable to deliver the relevant service.
05Sensors, Decoys and security evidence
Your organisation selects where to install Sensors and deploy Decoys. Tero records interactions with those Decoys so authorised users can detect suspicious access and investigate the evidence.
Records may be associated with an Environment, Sensor or Decoy to provide investigation context. Your organisation controls its monitoring purposes, user access and deployment choices, subject to the service terms.
We receive security and operational information from the Sensors and Decoys configured for the service. This is distinct from website analytics and may include personal information associated with an interaction.
Your organisation is responsible for providing appropriate notices and using monitoring lawfully within its environment. Contact it about requests concerning evidence it controls.
06Audience measurement and essential technologies
Google Analytics loads only after you explicitly accept optional analytics. Rejecting analytics does not affect authentication, enquiries, payments, licensing or the service. You can change your choice through Privacy preferences in the footer or Settings.
Google Analytics uses browser cookies after acceptance. We disable advertising features and Google Signals and do not set User-ID or link analytics to account, billing or security records. We do not enable session recording. Sensitive routes use generic categories; query strings, credentials and form contents are excluded. Read more about audience measurement.
Requests to our website necessarily involve technical information used to deliver and protect the service, such as network addresses. Aggregate reporting does not mean that account authentication or all server operations are anonymous.
Authentication and other essential service technologies operate separately from audience reporting. Third-party authentication and payment services may use technologies needed to provide their functions.
07Who receives information
We use service providers to support hosting, authentication, payment administration, business communications and customer support. These include WorkOS for authentication, Stripe for payment administration and HubSpot for submitted enquiries. Google receives optional analytics only after analytics consent. Information is shared as needed for the relevant service and the applicable relationship.
Authorised users within your organisation may access account information and security evidence according to their permissions. Your organisation determines the access it grants.
We may disclose information where necessary to comply with a legal obligation, respond to a valid legal request, establish or defend legal claims, or protect the rights and security of the service and its users.
International processing
The location of processing depends on the services and providers involved. Transfers of personal information outside the European Economic Area are subject to applicable data protection requirements. These may require an adequacy decision, contractual safeguards or another permitted transfer mechanism. Contact us for information about the safeguards relevant to your data.
08How long we keep information
We keep personal information for the period needed for its purpose, taking account of the service relationship, customer instructions, legal requirements and the establishment or defence of legal claims.
| Information | How retention is determined |
|---|---|
| Account information | For account administration during the service relationship and any necessary closure, legal or dispute-handling period. |
| Enquiries and support | For handling the enquiry and keeping relevant correspondence needed for follow-up or resolving issues. |
| Subscription records | For administering the subscription and meeting applicable accounting or other legal obligations. |
| Security evidence | According to the service configuration, applicable terms and customer instructions. |
| Audience aggregates | According to the configured aggregate retention period. |
Where continued retention is required by law or for a legal claim, access and use remain limited to that purpose. You can contact us for more information about the retention applicable to your data.
09Your privacy rights
Subject to applicable law and the relevant conditions, you may request access to your personal information, correction of inaccurate information, erasure, restriction of processing or a portable copy of information.
You may object to processing based on legitimate interests. Where processing relies on consent, you can withdraw that consent at any time. These rights can be subject to exceptions, including where information must be retained to meet a legal obligation or handle legal claims.
Send requests to support@terosecurity.com. We may ask for information needed to verify your identity and locate the relevant records. We respond within the time limits required by applicable law.
Where your organisation controls the relevant personal information, we may refer your request to it or assist it in responding under our service arrangements.
You may also complain to a competent data protection authority, including the authority in the country where you live, work or believe an infringement occurred. In Spain, you can contact the Agencia Española de Protección de Datos (AEPD).
10Contact and policy changes
For questions about this policy or the handling of your information, email support@terosecurity.com.
We may update this policy to reflect changes to the service, our practices or applicable requirements. Where required, we provide additional notice of material changes.
Contact Tero about privacy or a data request.