Privacy
policy.

The short version.

• This website has no cookies, no analytics, no ads, no forms and no accounts. Fonts and scripts load from our own site. We only get personal information from the site when you email us.
• When a company hires us, its administrator connects us to the company’s own systems, read-only by default. We use that access only to protect that company. The company decides what we can see and can remove our access at any time.
• For that client data, we work for the client. The client is in charge of the data (the “controller” or “business”). We process it on the client’s behalf (the “processor” or “service provider”).
• We never sell data, never use it for ads, and never use client data to train AI models, ours or anyone else’s.
• Data we get through Google APIs or Microsoft APIs is used only to deliver the security features the client signed up for, as Google’s and Microsoft’s developer rules require.
• When an engagement ends, we return the client’s data if it asks and delete it within 30 days.

Who we are.

YellowForce Inc. is a Delaware corporation that provides fully managed, AI-assisted cybersecurity.

• Address: 825 Geary St, Apt 1400, San Francisco, CA 94109, USA
• Phone: +1 (415) 583-7381
• Privacy questions and requests: privacy@yellow-force.com
• Security issues: security@yellow-force.com
• Legal notices and everything else: info@yellow-force.com
• Website: https://yellow-force.com

This policy has two parts. Part 1 covers yellow-force.com and people who contact us or work with us. Part 2 covers the data we access in our clients’ systems when we protect them. The sections after Part 2 apply to both.

Part 1: This website and people who contact us.

What we collect.

• Emails you send us. Your email address, your name if you include it, your message and anything you attach.
• Business contacts. If you work with us, or for one of our clients, we keep your name, work email, phone number and role so we can work together, plus normal business records such as contracts and invoices.
• Hosting logs. This site is hosted on GitHub Pages. GitHub may log technical data such as your IP address for security purposes. GitHub handles that data under its own privacy statement.
• Copy buttons. The buttons that copy our email address write to your clipboard. They don’t read your clipboard and don’t send anything anywhere.

We don’t collect anything else from this site.

How we use it.

We use what you send us to reply, to provide services you ask for, to keep normal business records, to protect our systems and to meet legal obligations. We don’t sell your personal information, and we don’t share it or use it for advertising.

If you are in the EU, the UK or Switzerland, our legal bases are: our legitimate interest in answering you and running our business, taking steps toward or performing a contract with you or your employer, and complying with the law.

Who else sees it.

Our email runs on Google Workspace and this site runs on GitHub Pages, so those providers process data on our behalf. Our lawyers, accountants and similar advisers may see it under confidentiality. We may also disclose information if the law requires it, or to a successor if YellowForce is ever merged or acquired. We never sell your data.

How long we keep it.

We keep emails as long as we need them for the conversation and our business records, then delete them. Contracts and invoices we keep as long as tax and corporate law require (usually up to 7 years). Ask us and we’ll delete your data sooner, unless the law requires us to keep it.

Do Not Track.

We don’t track visitors across sites, so Do Not Track and Global Privacy Control signals don’t change anything here.

Part 2: Client data we access to protect you.

Our role.

A client signs an order or engagement agreement with us, plus our Data Processing Addendum (https://yellow-force.com/dpa/). For the data we access in the client’s systems (“client data”):

• The client is the controller under the GDPR and UK GDPR, and the “business” under the California Consumer Privacy Act (CCPA, as amended by the CPRA).
• YellowForce is the processor and the “service provider”. We act only on the client’s documented instructions, which are set by its agreement with us and by the access its administrator grants.

If the client’s agreement and this policy differ, the agreement wins.

How we connect.

The client’s administrator grants our access. We don’t take access any other way, and we ask for the narrowest access the service needs. See how each integration works on our Integrations page.

What we access.

Depending on what you connect, client data can include:

• Identity and configuration data: user accounts, names, work emails, groups, roles, devices, cloud resources, settings and policies.
• Logs and events: sign-ins, audit trails, network and DNS events, cloud activity, including IP addresses, device identifiers and timestamps.
• Security data: alerts, incidents, vulnerabilities and findings from your security tools.
• Email and file data, only where you enable it: email metadata (sender, recipients, subject, time), file metadata (names, owners, sharing), and, where you turn it on, message or file content. Any of this can contain personal information about your employees and the people they deal with.

We don’t ask for special categories of data (such as health data), but email and file content may contain it. We treat all of it as confidential.

What we use it for.

Only to deliver the services you signed up for:

• detect threats, investigate them and respond where you authorize it;
• show you what is going on in your dashboard and reports;
• keep the service working and secure, and fix problems in it;
• comply with the law.

We don’t use client data for advertising or marketing, we don’t sell or “share” it (as the CCPA defines those words), we don’t use it to build profiles of people for any purpose other than protecting your systems, and we don’t combine it with data from other clients or other sources except as needed to deliver your services.

Response actions.

Some services include actions such as disabling an account, signing a user out, isolating a device or blocking an address. We take an action only when you have authorized it, either in advance in your agreement or runbook, or in the moment by a contact you named. Each action is logged and shown in your dashboard. Where an action needs more access than read-only, we ask for that permission separately, when you turn the action on.

Who can see it.

• Our security engineers. A small team, some of them based in India. Each person signs confidentiality terms, is trained on these rules, only sees the clients they work on, signs in with multi-factor authentication, and has their access logged. Engineers in India work remotely on our systems; the data is not stored there.
• AI models. We use AI models to help sort alerts, summarize investigations and draft reports. See “How we use AI”.
• Subprocessors. Providers that host or process data for us, listed at https://yellow-force.com/dpa/#subprocessors. We tell clients before we add a new one.
• Nobody else, unless you instruct us or the law requires it. If a government or court asks us for client data, we point them to you and tell you first, unless the law forbids that.

How we use AI.

• AI models analyze client data only to deliver your services. A person on our team reviews AI output before we take a response action.
• We don’t use client data, or anything derived from it, to create, train or improve AI or machine learning models. That includes our own models and any provider’s models.
• The AI providers we use process client data only to return results to us, under terms that forbid training on it.

Where it is stored.

We store client data with Amazon Web Services in the United States. If that ever changes, we update this policy and our subprocessor list first. Authorized engineers access it remotely, including from India. See “International transfers” below.

How long we keep it.

• Our credentials for your systems: kept encrypted for the engagement, disabled when it ends.
• Copies of logs, events and alerts: for the period in your order. If your order says nothing, up to 12 months.
• Email or file content copied for an investigation: deleted when the investigation closes, and no later than 90 days after we copied it.
• When the engagement ends: if you ask, we return your data in a standard format. We delete client data, including backups, within 30 days of the end date. We keep only what the law requires, such as contracts, invoices and a short record of incidents we handled, without email or file content.

You can also ask us to delete specific data earlier: privacy@yellow-force.com.

How we protect it.

• Read-only access by default, and only the permissions the service needs.
• Encryption in transit (TLS) and at rest.
• Multi-factor authentication for all our staff and systems.
• A separate, encrypted secret vault for each client’s credentials and tokens.
• Logging of who accessed what, and when.
• Access removed when a person leaves or changes role, and when an engagement ends.

If we learn of a security incident affecting client data, we tell the affected client without undue delay and within 48 hours.

Google user data.

This section covers data we receive from Google APIs, including Google Workspace APIs and Google Cloud APIs.

What we access. Only the scopes your administrator approves. By default:

• Directory data (users, groups, admin roles, domains, mobile and ChromeOS devices), through read-only Admin SDK scopes: admin.directory.user.readonly, admin.directory.group.readonly, admin.directory.rolemanagement.readonly, admin.directory.domain.readonly, admin.directory.device.mobile.readonly, admin.directory.device.chromeos.readonly.
• Audit and activity logs: admin.reports.audit.readonly.
• Alert Center alerts: apps.alerts, which we use to read alerts and record feedback on them.
• Only if you add email or file coverage: Gmail messages through gmail.readonly (this can include message content and attachments), and Drive file metadata through drive.metadata.readonly (names, owners and sharing settings, not file content).
• Google Cloud: resource configuration, IAM policies, logs and Security Command Center findings, through the IAM roles you grant our service account.
• If you turn on response actions, we ask for the extra scope at that time (for example, to suspend a compromised account) and use it only for the actions you approved.

How we use it. Only to provide and improve the security features you see in your YellowForce dashboard and reports: detecting threats, investigating them, responding where you authorize it, and reporting to you.

When people read it. Our people read Google user data only when (a) you have given, and we have documented, your explicit agreement for us to view it, which you give in your order for alerts and logs, and separately for each investigation for specific emails or files; (b) it is necessary for security purposes, such as investigating an attack, a bug or abuse; (c) it is necessary to comply with the law; or (d) it is aggregated and anonymized and used for our internal operations, as the law allows.

How we share it. We transfer Google user data only: to the subprocessors that help us provide your security features, under contract and as part of the service you agreed to; for security purposes, such as investigating abuse; to comply with the law; or as part of a merger, acquisition or sale of our assets, and then only after getting your explicit prior consent.

What we never do with it. We never transfer or sell Google user data to advertising platforms, data brokers or other information resellers. We never use it for serving ads, including retargeting, personalized or interest-based ads. We never use it to determine credit-worthiness or for lending. We never use it to create, train or improve any machine learning or artificial intelligence model, generalized or personalized, and we never store it with or inside such a model.

Storage and deletion. We store it encrypted in our client data environment (see “Where it is stored”), keep it for the periods in “How long we keep it”, and delete it within 30 days after you remove our access or the engagement ends, or sooner if you ask. Our Google tokens and keys are kept encrypted in your client vault.

Limited Use. YellowForce’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. YellowForce’s use of information received from Google Workspace scopes will also adhere to the Google Workspace User Data and Developer Policy, including its Limited Use requirements.

Microsoft data.

We apply the same rules to data we receive through Microsoft Graph, the Microsoft Defender APIs and Azure (through Azure Lighthouse), and we follow the Microsoft APIs Terms of Use:

• We request only the permissions your administrator consents to, and no more than the service needs. By default these are read-only. For email, the default is Mail.ReadBasic.All, which covers metadata and not message bodies.
• We use the data only to deliver your security services, within the permissions you granted.
• We never use or transfer it, or anything aggregated, anonymized or derived from it, for advertising or marketing. We never sell, resell or redistribute it, and never use it to train AI models.
• We keep copies only where a feature needs them, keep them current, and delete them when you tell us to or when the engagement ends.

How to remove our access.

You can remove our access at any time. This stops the service for that system. Tell us too, so we can disable our side and start deletion.

• AWS: delete the YellowForce IAM role, or the CloudFormation stack or StackSet that created it.
• Microsoft Entra ID and Microsoft 365: in the Microsoft Entra admin center, go to Enterprise applications, open YellowForce, and delete it or revoke its permissions. Users can see apps that have access at https://myapps.microsoft.com.
• Azure: in the Azure portal, open Service providers, then Delegations, and remove the YellowForce delegation.
• Google Workspace: in the Admin console, go to Security, then Access and data control, then API controls. Under Manage Domain Wide Delegation, delete the YellowForce client ID, or remove YellowForce under third-party app access.
• Google Cloud: remove the IAM roles granted to our service account.
• GitHub: uninstall the YellowForce GitHub App in your organization settings.
• Cloudflare: revoke the YellowForce API token or OAuth grant.
• Other tools: delete the API client or app you created for us.

If you work for one of our clients.

If we process your data because your employer is our client, your employer decides how it is used. Please send requests to your employer first. If you contact us, we will pass your request to them and help them answer it.

Applies to both parts.

Your rights.

You can ask us what we hold about you, and ask us to correct it, delete it, give you a copy, or stop or limit using it. Email privacy@yellow-force.com. Depending on where you live, for example California, the EU or the UK, the law gives you these rights. We honor them for everyone, and we won’t treat you differently for using them. We may need to confirm your identity first. An authorized agent can make a request for you with your signed permission.

For client data, we act on these requests through the client, as described above.

California.

This section adds what the CCPA requires.

• Categories we collected in the last 12 months, as a business (Part 1): identifiers (name, email address, phone number), professional information (job title, employer) and the content of your messages. Sources: you, or your employer. Purposes: those in “How we use it”. Retention: see “How long we keep it”.
• Selling and sharing: we have not sold or shared personal information, and we don’t do so. We don’t knowingly collect data of anyone under 16.
• Sensitive personal information: we don’t use it to infer characteristics about people.
• As a service provider (Part 2): we don’t sell or share client data; we don’t retain, use or disclose it for any purpose other than the services in our agreement, or outside our direct business relationship with the client; and we don’t combine it with other personal information except as the CCPA allows.

EU, UK and Switzerland.

• For Part 1 data, YellowForce Inc. is the controller. Legal bases are in “How we use it”.
• For Part 2 data, our client is the controller and we are its processor, under our Data Processing Addendum.
• You can complain to your local data protection authority. We would like the chance to fix things first: privacy@yellow-force.com.

International transfers.

We are based in the United States, and data is processed in the US and wherever our providers operate. Authorized engineers access client data remotely from India. When personal data from the EU, the UK or Switzerland is transferred, we use the European Commission’s Standard Contractual Clauses, with the UK Addendum and the Swiss adjustments, as set out in our Data Processing Addendum.

Children.

This site and our services are for businesses. They aren’t meant for children under 13, and we don’t knowingly collect their information.

Changes.

If we change this policy, we’ll update it here and change the effective date at the top. If a change affects client data, we will tell clients in advance. We will not use Google user data or Microsoft data in a new way, or for a new purpose, until the client’s administrator has been told and has agreed.

Contact.

Privacy: privacy@yellow-force.com. Security: security@yellow-force.com. Legal notices: info@yellow-force.com. Mail: YellowForce Inc., 825 Geary St, Apt 1400, San Francisco, CA 94109, USA. Phone: +1 (415) 583-7381.