Company and privacy information

Business identity

This service is operated by ABC CYBER LTD, a private limited company registered in England and Wales under company number 16941187.

Registered office: Brundrett House, Sandbach Road South, Alsager, Stoke-on-Trent, England, ST7 2LT.

Questions and data-protection requests may be sent in writing to the registered office. Mark correspondence for the attention of Data Protection.

Data processed by the Portal

Microsoft Entra authenticates the user and supplies identity, role and group claims. The Portal stores the Entra subject identifier, display name, authentication method, local session and security timestamps, and sign-in audit events in its private PostgreSQL database. It does not retain the user's Microsoft password or a persistent Microsoft access token.

Restricted recovery accounts additionally store a username, password hash, encrypted authenticator seed and failed-attempt state. This information is used to authenticate authorised personnel, enforce access controls, protect the service and investigate security events.

The Runbooks & Templates library stores document metadata, version history, publisher identifiers and encrypted document content. Publishing actions, archive changes and downloads are recorded for security and operational accountability. Documents should contain only information appropriate for the authorised ABC Cyber workforce.

Access administration stores Entra subject identifiers, display names, application roles, module assignments and the identity of the administrator making each change. GRC and Alerts retain their own authoritative account roles, customer grants and corresponding audit events.

Where ABC Cyber acts as controller, it relies on legitimate interests in administering and securing its business systems and, where applicable, legal obligations. These interests are limited by the rights and interests of affected individuals.

Cookies and similar storage

The Portal uses only strictly necessary host-only cookies for the signed-in session and short-lived OAuth security flow. Browser local and session storage are cleared on logout. No advertising cookies, behavioural analytics, tracking pixels, social widgets or third-party embeds are used, so there is no optional tracking to accept or reject.

Data sharing and retention

Microsoft Entra processes authentication data. The self-hosted application and its private PostgreSQL database process session, resource-library and audit data. Data is disclosed only to authorised users and administrators, contracted service providers where necessary, or authorities where legally required. Where a provider transfers personal data outside the UK, ABC Cyber uses an applicable UK adequacy regulation or approved safeguard.

Sessions expire after 30 minutes of inactivity and no later than one hour. OAuth transactions expire after five minutes. Security audit events and recovery records are retained under ABC Cyber's documented security and account lifecycle requirements and removed when no longer required.

Your rights and complaints

Depending on the circumstances, individuals may have rights of access, correction, erasure, restriction, objection and data portability. They may also complain to the UK Information Commissioner's Office. Rights can be exercised by writing to the registered office above. Identity verification may be required before disclosing or changing personal data.