CYRUS

Effective Date: September 28, 2026

This Privacy Policy and Data Processing Agreement ("Agreement" or "Policy") legally governs the collection, processing, storage, and protection of data derived from or transmitted through the Cyrus Cybersmith platform ("Platform"), accessible via cyruscybersmith.ai, owned and operated by The One STP, Inc. ("Company," "we," "us," or "our"). By accessing, integrating with, or otherwise utilizing the Platform, the legal entity or corporate user ("Client," "you," or "your") unconditionally assents to and agrees to be bound by the terms, obligations, and data handling protocols set forth herein.

This Agreement formally articulates the Company's administrative, technical, and physical safeguards mandated for all information ingested, processed, or transmitted during the 90-day Baseline Risk Assessment phase and all subsequent operational engagements.

1. CATEGORIES OF PROCESSED DATA

To execute risk analytics, threat modeling, vulnerability mapping, and regulatory compliance evaluations, the Company shall collect and process the following distinct categories of data:

1.1 Corporate & Identity Data: Entity registration credentials, corporate structure identifiers, designated administrative point-of-contact details (including full names, professional email addresses, telephone numbers), and physical business addresses.

1.2 System Infrastructure & Telemetry Data: Technical environment metadata extracted via API integrations with Client-managed cloud service providers and repositories (e.g., AWS, GCP, GitHub), including infrastructure configuration parameters, technical vulnerability logs, Identity and Access Management (IAM) configurations, and continuous security posture metrics.

1.3 Proprietary Documentation & Governance Inputs: Internal control checklists, governance policies, data classification inventories, compliance artifacts, and administrative entries submitted directly into the Platform's workflow tools.

2. AUTHORIZED PURPOSES OF PROCESSING

The Company processes collected information exclusively for explicit, specified, and contractually authorized operational purposes, including to:

2.1 Construct tailored quantitative risk profiles and execute advanced loss expectancy simulations, including Monte Carlo calculations for Annualized Loss Expectancy (ALE) modeling.

2.2 Map internal security controls against established regulatory standards and industry frameworks, including but not limited to SOC 2, ISO/IEC 27001, NIST SP 800-53, HIPAA, and the Secure Controls Framework (SCF).

2.3 Facilitate expert validation workflows, deliver real-time platform analytics, and populate executive virtual CISO dashboard interfaces.

2.4 Maintain, secure, audit, troubleshoot, and optimize the operational stability, reliability, and security posture of the Platform.

3. MULTI-TENANT ARCHITECTURE & DATA SEGREGATION

The Platform enforces strict logical and database-level multi-tenant isolation. All Client infrastructure telemetry, configuration logs, and proprietary records are stored in logically segregated tenant environments. The Company strictly covenants that it shall not sell, lease, commercialize, or cross-contaminate Client metrics or security profiles with any third party or other platform tenant.

4. THIRD-PARTY INTEGRATIONS & AI MODEL GOVERNANCE

The Platform integrates enterprise-tier API endpoints provided by third-party artificial intelligence infrastructure providers (e.g., OpenAI, Google Gemini, Anthropic Claude) to execute automated workflows, including policy generation and control synthesis. All such integrations are strictly governed by enterprise-level contractual covenants that explicitly prohibit the use of Client inputs, system metadata, or proprietary telemetry for base model training, re-training, or fine-tuning.

5. EVALUATION PERIOD & DEFINITIVE AGREEMENTS

This Agreement governs all data processing activities conducted during the initial evaluation or assessment period. Upon conversion to a commercial enterprise subscription, comprehensive data retention schedules, service level agreements (SLAs), and custom security protocols shall be subsumed and governed by a fully executed Master Services Agreement (MSA) and dedicated Data Processing Addendum (DPA).

6. NOTICES & DATA PROTECTION INQUIRIES

Formal legal notices or inquiries regarding this Policy and data protection compliance should be submitted in writing to the Company's designated Data Protection Officer:

Electronic Mail: support@theonestp.com

Postal Address: The One STP, Inc., Attn: Legal & Privacy Dept., 20627 12th Ave S, Seatac, WA 98198, USA