Privacy Policy

We process personal data under the following legal bases as defined in GDPR Article 6(1):

Guardian Posse includes cybersecurity tools for blue team operations, red team operations, purple team operations, OSINT research, network analysis, SIEM integration, API monitoring, and the Security Arsenal 42 toolkit. The following applies to data processed through these features.

9.1 PCAP File Analysis

• PCAP files are uploaded for in-browser analysis
• Network traffic data is processed locally and on our servers for AI-assisted analysis
• PCAP files are not retained long-term — they are deleted after analysis completion or within 24 hours, whichever is sooner
• Analysis results may be stored if the user saves them to a project

9.2 OSINT Query Data

• Search queries submitted to OSINT tools are logged for audit purposes
• Query results from external sources are displayed but not permanently stored unless saved by user
• IP addresses, domains, and indicators of compromise queried are logged for security audit trails

9.3 Vulnerability & Security Assessments

• Vulnerability scan results are stored in your account for ongoing monitoring
• NIST/CMMC assessment scores and evidence are retained as compliance documentation
• Security assessment data may be shared with authorized auditors upon your request

9.4 Relay Agent Infrastructure Monitoring

• Relay agents deployed on client infrastructure transmit health metrics, heartbeat data, and system inventory back to the platform
• Configuration drift detection identifies unauthorized changes to client systems and reports deviations to the platform
• Security scan results from relay agents (static analysis, network forensics) are collected and stored for analysis
• All relay-to-platform communication is authenticated via JWT tokens and encrypted in transit

9.4b Enhanced Relay Installer Monitoring

• Enhanced Installer v3.0 scripts perform a 10-phase automated deployment including environment setup, Python installation, relay client, 12-agent fleet, SSL/CertBot, firewall hardening, service registration, and health verification
• Installer health check results (8-point validation) are transmitted to the platform upon completion to confirm successful deployment
• SSL certificates provisioned through the installer’s CertBot automation (via Sectigo CA) are tracked for renewal scheduling
• Firewall rules and security hardening configurations applied by the installer are logged for compliance documentation

9.4c CertBot SSL Certificate Monitoring

• The CertBot SSL Certificate Manager tracks certificate issuance, renewal schedules, and expiration dates for all managed domains
• Certificate status checks query the target server and report back to the platform for dashboard display
• Renewal and revocation operations are logged with timestamps and outcome status for audit purposes
• All certificate operations are restricted to admin-level platform access

9.5 Browser Extension Monitoring

• The Guardian Relay Browser Extension polls your platform instance for relay status at configurable intervals (default: 30 seconds)
• Extension configuration (platform URL, preferences) is stored locally in chrome.storage.sync and synced across your Chrome profile
• Desktop notifications are generated locally by the extension when relay agents go offline — no notification data is sent externally
• Dispatch commands issued through the extension are routed through the same authenticated API endpoints used by the main platform dashboard
• The extension does not inject content scripts, modify web pages, or intercept browsing data
• No data is collected, transmitted, or shared with CPWE AI or third parties by the extension itself — all communication flows directly to your configured platform

9.6 Active Defense Operations

• Active defense tools collect IP lookup data, attacker profiling information, and threat intelligence indicators
• AI-powered attacker profiles are generated from observed threat patterns and MITRE ATT&CK mappings
• Abuse reports and legal counter-measures (cease & desist notices, law enforcement referrals) are generated and logged

9.7 Honeypot Trap Data Collection

• Honeypot traps (SSH, Web, DB, SMB, RDP, IoT) collect attacker interaction data for threat intelligence purposes
• Honeypot deployment logs record trap configurations, attacker connection metadata, and captured payloads
• Honeypot data is retained for 6 months and used exclusively for threat detection and security research

9.8 Physical Penetration Testing Data

• The Physical Pen Test Command Center deploys a 30-device hardware security arsenal for authorized penetration testing engagements
• Device categories include USB implants, network taps, RF analyzers, RFID/NFC tools, Bluetooth monitors, wireless auditing equipment, AI WiFi auditors, hardware security research tools, wearable pen test devices, and USB resilience testers
• Mission execution data includes device deployment logs, payload configurations, C2 mesh network topology, and engagement evidence
• ICS/SCADA safety assessments record Purdue Model compliance, IEC 62443 alignment, and Layer 2 PLC safety classifications
• All pen test data requires written client authorization and is retained per engagement contract terms (default: 12 months)
• AI-assisted analysis results (payload generation, loot analysis, defense assessments) are processed through the platform’s AI providers

9c.1 Tool Registry Data

• The Security Arsenal maintains a registry of 42 tools with metadata including tool names, versions, categories, MITRE ATT&CK mappings, and NIST 800-53 control mappings
• Tool registry data is static configuration and does not contain personal information
• Tool integration status and availability metrics are tracked for operational purposes

9c.2 Scan & Assessment Data

• When users initiate scans using Arsenal tools, the following data is collected: tool ID, target specification, scan type, timestamp, and scan results summary
• Scan targets (domains, IPs, URLs) provided by users are logged for audit trail purposes
• Scan results are stored in-memory with automatic rotation (most recent 500 scans retained)
• Users are responsible for ensuring scan targets are authorized and lawful

9c.3 OSINT Data

• OSINT tools (SpiderFoot, Recon-ng, theHarvester, Shodan, Sherlock, Maltego) may process publicly available information including domain records, email addresses, social media profiles, and network infrastructure data
• OSINT query parameters and results are processed in accordance with Section 9.2 of this Privacy Policy
• Data obtained through OSINT tools originates from public sources; CPWE AI does not independently verify the accuracy of such data

9c.4 Open-Source SIEM Connector Data

• The Arsenal provides API connectors for Wazuh, Graylog, and ELK Stack in addition to the Splunk integration described in Section 9b
• SIEM connector configuration data (endpoint URLs, authentication credentials) is stored encrypted
• Event data forwarded to third-party SIEM platforms is subject to those platforms' respective privacy policies
• CPWE AI does not access, monitor, or store data within your SIEM deployments

9d.1 Transaction Logging

• API Overwatch logs API transactions including HTTP method, endpoint path, status code, response time, request size, and timestamp
• Transaction logs are stored in-memory and are automatically rotated (most recent 10,000 transactions retained)
• Transaction logs do not contain request/response bodies, authentication tokens, or personal data beyond user ID association

9d.2 Anomaly Detection Data

• Anomaly detection flags transactions matching patterns such as slow responses, rate limiting, server errors, and potential brute-force authentication attempts
• Anomaly alerts are stored in-memory with automatic rotation (most recent 1,000 anomalies retained)
• Anomaly data is used solely for platform security monitoring and is not shared with third parties

9d.3 Data Retention

All API Overwatch data is stored in volatile memory (RAM) and is not persisted to disk or database. Data is automatically purged when memory rotation thresholds are reached or when the application restarts. No API Overwatch data survives application restarts.

Your data may be processed in the following jurisdictions:

• United States: Primary hosting infrastructure and data processing (all military/CUI data remains US-only)
• European Union: For EU users, transfers are protected under EU-US Data Privacy Framework adequacy decisions
• AI Provider Locations: As determined by your selected AI provider's infrastructure

Transfer Safeguards

• Standard Contractual Clauses (SCCs): Applied to all data transfers outside the EEA where no adequacy decision exists
• EU-US Data Privacy Framework: Relied upon where applicable for transatlantic transfers
• Data Residency Restrictions: Military and CUI data is restricted to US-based servers and US-based AI provider endpoints
• Supplementary Measures: Encryption in transit and at rest, access controls, and regular transfer impact assessments

Guardian Posse AI Platform includes educational and creative features (comic creation, curriculum building) that may be used in K-12 educational settings. We take the protection of children's privacy seriously.

16.1 Parental/Guardian Consent

• If we become aware that a child under 13 has provided personal information without parental consent, we will promptly delete such data
• Parents or guardians may contact us at james@cpwe.biz to review, delete, or refuse further collection of their child's information
• Schools using Guardian Posse for educational purposes may provide consent on behalf of parents under COPPA's school consent exception

16.2 Educational Use

When used in educational settings for K-12 curriculum building or creative projects, educators are responsible for ensuring compliance with applicable age-gating requirements and obtaining necessary consents.