Privacy Policy & Data Processing Agreement

Version 2026-09-29 (current) · All versions: 2026-09-29, 2026-09-28

Effective Date: September 29, 2026

This Privacy Policy and Data Processing Agreement ("Agreement" or "Policy") legally governs the collection, processing, storage, and protection of data derived from or transmitted through the Cyrus Cybersmith platform ("Platform"), accessible via cyruscybersmith.ai, owned and operated by The One STP, Inc. ("Company," "we," "us," or "our"). By accessing, integrating with, or otherwise utilizing the Platform, the legal entity or corporate user ("Client," "you," or "your") unconditionally assents to and agrees to be bound by the terms, obligations, and data handling protocols set forth herein.

This Agreement formally articulates the Company's administrative, technical, and physical safeguards mandated for all information ingested, processed, or transmitted during the 90-day Baseline Risk Assessment phase and all subsequent operational engagements.

1. CATEGORIES OF PROCESSED DATA

To execute risk analytics, threat modeling, vulnerability mapping, and regulatory compliance evaluations, the Company shall collect and process the following distinct categories of data:

1.1 Corporate & Identity Data: Entity registration credentials, corporate structure identifiers, designated administrative point-of-contact details (including full names, professional email addresses, telephone numbers), and physical business addresses.

1.2 System Infrastructure & Telemetry Data: Technical environment metadata extracted via API integrations with Client-managed cloud service providers and repositories (e.g., AWS, GCP, GitHub), including infrastructure configuration parameters, technical vulnerability logs, Identity and Access Management (IAM) configurations, and continuous security posture metrics.

1.3 Proprietary Documentation & Governance Inputs: Internal control checklists, governance policies, data classification inventories, compliance artifacts, and administrative entries submitted directly into the Platform's workflow tools.

2. AUTHORIZED PURPOSES OF PROCESSING

The Company processes collected information exclusively for explicit, specified, and contractually authorized operational purposes, including to:

2.1 Construct tailored quantitative risk profiles and execute advanced loss expectancy simulations, including Monte Carlo calculations for Annualized Loss Expectancy (ALE) modeling.

2.2 Map internal security controls against established regulatory standards and industry frameworks, including but not limited to SOC 2, ISO/IEC 27001, NIST SP 800-53, and HIPAA.

2.3 Facilitate expert validation workflows, deliver real-time platform analytics, and populate executive virtual CISO dashboard interfaces.

2.4 Maintain, secure, audit, troubleshoot, and optimize the operational stability, reliability, and security posture of the Platform.

3. MULTI-TENANT ARCHITECTURE & DATA SEGREGATION

The Platform enforces strict logical and database-level multi-tenant isolation. All Client infrastructure telemetry, configuration logs, and proprietary records are stored in logically segregated tenant environments. The Company strictly covenants that it shall not sell, lease, commercialize, or cross-contaminate Client metrics or security profiles with any third party or other platform tenant.

4. THIRD-PARTY INTEGRATIONS & AI MODEL GOVERNANCE

By default, the Platform executes automated workflows, including policy generation and control synthesis, through Google Gemini on Google Cloud Vertex AI. That integration is governed by enterprise-level contractual covenants that explicitly prohibit the use of Client inputs, system metadata, or proprietary telemetry for base model training, re-training, or fine-tuning.

A Client may instead configure its own artificial intelligence provider for its tenant (for example, OpenAI, Microsoft Azure OpenAI, Anthropic Claude, or a self-hosted model), using credentials the Client supplies. Where a Client does so, the inputs to those workflows are transmitted to that provider and are governed by the Client's own agreement with it, including that provider's data retention and model training terms. The Company stores Client-supplied credentials encrypted and uses them solely to execute the Client's workflows.

5. EVALUATION PERIOD & DEFINITIVE AGREEMENTS

This Agreement governs all data processing activities conducted during the initial evaluation or assessment period. Upon conversion to a commercial enterprise subscription, comprehensive data retention schedules, service level agreements (SLAs), and custom security protocols shall be subsumed and governed by a fully executed Master Services Agreement (MSA) and dedicated Data Processing Addendum (DPA).

6. NOTICES & DATA PROTECTION INQUIRIES

Formal legal notices or inquiries regarding this Policy and data protection compliance should be submitted in writing to the Company's designated Data Protection Officer:

Electronic Mail: support@theonestp.com