Privacy Policy

1. Information We Collect

We collect only the information necessary to operate and protect our services.

1a. Information you provide

Email address (if provided) — Used to enforce usage limits and prevent abuse. By entering your email and clicking the "Get Full Report" button, you consent to the use of your email to send you occasional AWS security insights from Osias. You may unsubscribe at any time by emailing hello@osias.io.

1b. Information collected automatically

IP address (tools) (temporary use only) — When you use our tools, your IP address is used solely for abuse prevention and rate limiting. This rate-limiting IP is not used for tracking, profiling, or analytics. It expires after 24 hours and is scheduled for deletion shortly thereafter.

Website analytics — On our website we use a third-party analytics partner, Apollo, to understand how visitors find and use our site. Apollo sets a cookie and processes your IP address, which it uses to estimate your general location and, for business visitors, to identify the organization a visit comes from. This is analytics and lead generation, not advertising. You control it through the cookie consent banner; see Section 5.

Usage data — Includes interactions with our tools such as number of analyses performed. Used for enforcing limits and improving performance.

1c. Content you submit for analysis

IAM policy content — When you submit an IAM policy for analysis, that content is transmitted to Anthropic's API for processing. Osias does not store, log, or retain submitted IAM policy content. Policy content is used solely to generate the analysis result and is not retained after the response is returned.

1d. Security Baseline Assessment

Assessment details and responses — When you complete the AWS Security Baseline Assessment, we store the contact details you provide (name, work email, company, industry) and your assessment responses (your selected answers and the resulting scores). This information is used to generate your results, for internal review, and to follow up with you about your AWS security posture. Scoring happens in your browser; the data is sent only when you complete the assessment.

2. How We Use Information

We use collected information strictly to:

• Operate and provide our tools
• Enforce usage limits and prevent abuse
• Protect the security and integrity of our services
• Improve performance and reliability
• Send occasional AWS security insights to users who have consented at the time of email submission

We do not use your data for advertising. On our website we use a third-party analytics partner (Apollo) to understand site traffic and identify business visitors; you can opt out at any time, as described in Section 5.

2A. Legal Basis for Processing

We process personal data under the following legal bases:

• Legitimate interest — to operate the service, prevent abuse, and ensure security
• Consent — for sending AWS security insights via email where you have provided your email and requested a report

3. Data Retention

We retain data only as long as necessary:

• Email address (outreach): retained until you unsubscribe or request deletion
• Security Baseline Assessment responses (detail): retained up to 12 months for internal review, then automatically deleted
• Security Baseline Assessment contact record: retained until you unsubscribe or request deletion
• Email-derived identifiers (rate limiting): expire after 24 hours and are scheduled for deletion shortly thereafter
• IP addresses: expire after 24 hours and are scheduled for deletion shortly thereafter
• Usage data: expire after 24 hours and are scheduled for deletion shortly thereafter
• IAM policy content: not retained

4. Data Sharing

We do not sell your personal information. We share limited data with the service providers below so they can operate features of our website and tools.

We use trusted service providers to operate our services:

• Amazon Web Services — hosting and infrastructure
• Anthropic — AI processing for analysis results. IAM policy content is transmitted solely to generate analysis results and is not retained by Osias. Processing by Anthropic is subject to their privacy policy.
• Apollo — website visitor analytics. Where consent applies, Apollo receives your IP address and a cookie identifier to measure site traffic and identify visiting organizations. Processing by Apollo is subject to their privacy policy. Under some U.S. state privacy laws this may be considered "sharing"; you can opt out at any time through the cookie banner (see Section 5).
• Cloudflare — DNS validation used to verify email domains at the time of submission. Only the email domain name is transmitted, no personal data beyond the domain.

These providers process data only as necessary to deliver the service.

California residents: we do not sell your personal information. To opt out of analytics "sharing," use the "Cookie preferences" link in the website footer or decline on the cookie banner.

5. Cookies and Local Storage

We do not use cookies for advertising.

Analytics cookie. Our website uses one analytics cookie, set by our third-party partner Apollo, to measure site traffic and identify visiting organizations. We ask for your choice through a cookie consent banner, and the default depends on your location:

• EU, UK, EEA, and Switzerland: the Apollo cookie does not load unless you accept (opt-in).
• United States and elsewhere: the cookie loads by default, and you can decline at any time (opt-out).

You can change or withdraw your choice at any time using the "Cookie preferences" link in the website footer. Declining stops Apollo from loading on future visits and removes it from the current page.

Local storage. Our tools use browser localStorage solely to enforce the 60-second cooldown between analyses, to remember your cookie choice, and to store your email address client-side for your convenience. This data is not transmitted to third parties and remains on your device until cleared by you.

6. Security

We implement reasonable technical and organizational measures to protect your data. We minimize data collection and limit retention to reduce risk.

7. Your Rights

You may request deletion of your data by contacting us at hello@osias.io. We will respond within 30 days.

To unsubscribe from Osias security insights emails, reply to any email with "unsubscribe" in the subject line or email hello@osias.io directly. We will process unsubscribe requests within 5 business days.

8. International Users

Our services are operated in the United States. By using our services, you understand that your information may be processed in the U.S.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Updates will be posted on this page with a revised effective date.

10. Contact

If you have any questions about this Privacy Policy, contact us at hello@osias.io.