Company Privacy Policy
How AXUM SEC Technology PLC collects, uses, shares, retains and protects personal data across its security platform — company workspaces, researcher accounts, PTaaS engagements, bounty payouts, financial services and support — and the rights available to the people whose data it is.
1. Who we are
AXUM SEC Technology PLC ("AXUM SEC", "we", "us") provides security testing and security operations services: managed bug bounty and vulnerability disclosure programmes, penetration testing as a service (PTaaS), continuous security monitoring, security reporting and remediation tracking, and the related workspace, financial and file services we offer alongside them.
We are the controller of the personal data described in this policy. For data our customers upload into their own workspace — their staff, their findings, their assets — we act as a processor on their instructions, and their own privacy notice governs that processing.
Contact: privacy@axumsec.com Postal: AXUM SEC Technology PLC, Addis Ababa, Ethiopia (attention: Privacy)
We do not sell personal data, and we do not use it for advertising.
2. The data we process
2.1 Account and workspace data
Name, work email, phone number, username, hashed password, role and permissions, workspace membership, profile image, authentication events (including multi-factor enrolment and verification), device and session identifiers.
2.2 Company and onboarding data
Company name and legal name, registration and tax identifiers, company address and contact details, website, security contact, subscription and service entitlements, and KYB (know-your-business) verification material.
2.3 Researcher (hunter) data
Display name, username, email, profile and skills, participation history, submitted reports and their content, reputation, and — for payouts — identity verification material (which may include a government identity document, address, tax identifier and payment account details) and tax forms.
2.4 Engagement and security testing data
Programme scopes (domains, IP ranges, application and API identifiers), targets, testing windows, credentials issued for testing, findings and submissions, severity and CVSS data, proof-of-concept evidence, comments, remediation tasks, and status history.
Where a customer's testing scope touches systems that hold personal data, that agreement sits between the customer and us as processor. We ask customers to scope out production personal data and provide synthetic test data instead.
2.5 Financial data
Wallet balance and ledger entries, bounties and rewards, invoices, payment method references, transaction history, refunds, and the accounting records the law requires us to keep. We do not store full card numbers — payment instruments are handled by our payment providers.
2.6 Usage, diagnostics and security data
Pages and features used, timestamps, IP address, browser and device information, error and performance diagnostics, rate-limiting and bot-protection signals (including Cloudflare Turnstile), and audit logs of privileged actions.
2.7 Communications
Support tickets, chat and in-platform messages, email correspondence, and notification delivery records.
2.8 Automated and assisted analysis
Some features use automation (including AI-assisted drafting, triage and summarisation) to help our team and our customers. Outputs are labelled as such, are reviewed by a human before they are relied upon for a decision that affects a person, and are not used to make solely automated decisions that produce legal or similarly significant effects.
We do not intentionally collect special category data. If you volunteer it to us, we handle it with additional care and restricted access.
3. Why we process it, and on what basis
| Purpose | Data | Lawful basis |
|---|---|---|
| Creating and operating accounts and workspaces | 2.1, 2.2 | Performance of a contract |
| Delivering and managing engagements, programmes and reports | 2.2, 2.3, 2.4 | Performance of a contract |
| Paying rewards and processing payouts | 2.3, 2.5 | Contract; legal obligation (tax, anti-money-laundering) |
| Verifying identity and business (KYB/KYC) | 2.2, 2.3 | Legal obligation; legitimate interests (fraud prevention) |
| Invoicing, accounting and statutory records | 2.5 | Legal obligation |
| Securing the platform, preventing abuse and detecting fraud | 2.1, 2.6 | Legitimate interests (documented in our legitimate interests assessment) |
| Providing support and responding to you | 2.7 | Contract; legitimate interests |
| Product improvement and aggregate analytics | 2.6 | Legitimate interests, using aggregated or de-identified data wherever possible |
| Service and security notifications | 2.1, 2.7 | Contract; legal obligation |
| Optional marketing | 2.1, 2.7 | Consent, withdrawable at any time |
Where we rely on legitimate interests, we balance them against your rights and you may object at any time (§7).
4. Cookies and similar technologies
We use strictly necessary cookies and local storage to keep you signed in, protect forms against cross-site request forgery, remember your theme and preferences, and detect abusive traffic. Optional analytics are used only where consent has been given, and can be refused without losing access to the service.
We do not use advertising cookies or third-party tracking for profiling.
5. Who we share it with
- Customers and programme owners — the findings, reports and researcher display profile needed to run the engagement. We do not disclose a researcher's identity, contact details or payout data to a customer unless the engagement or the law requires it.
- Researchers — the programme scope and detail required to test and report.
- Service providers (sub-processors) — hosting and infrastructure, database and storage, content delivery and bot protection, email and notification delivery, payment processing, identity and business verification, and support tooling. Each is bound by written data-processing terms, limited to what the service requires, and listed in our sub-processor register.
- Professional advisers — auditors, insurers and lawyers, under confidentiality.
- Authorities — where we are legally required, or where disclosure is necessary to establish, exercise or defend a legal claim, or to protect someone's vital interests.
- Corporate transactions — a successor entity in a merger or acquisition, under equivalent obligations.
We do not sell personal data.
6. International transfers
We operate from Ethiopia and use service providers in other countries, including the European Union and the United States. Where personal data leaves its country of origin we use an approved transfer mechanism — an adequacy decision where one exists, otherwise standard contractual clauses together with a transfer risk assessment and supplementary safeguards such as encryption in transit and at rest. Our sub-processor register records the mechanism for each provider.
7. Your rights
Subject to applicable law, you may request to:
- access the personal data we hold about you;
- correct data that is inaccurate or incomplete;
- delete data we no longer need;
- restrict or object to processing, including profiling;
- port data you gave us, in a machine-readable format;
- withdraw consent at any time, without affecting processing already carried out;
- complain to a supervisory authority.
Send requests to privacy@axumsec.com. We verify your identity before acting, respond within one month, and will tell you if we need an extension and why. If you are in the EU/EEA or UK you may complain to your local supervisory authority; in Ethiopia, to the Ethiopian Data Protection Authority. We would appreciate the chance to resolve it with you first.
You can also object to direct marketing at any time using the unsubscribe link in any message, which takes effect immediately.
8. How long we keep it
| Data | Retention |
|---|---|
| Account and workspace records | While the account is active, then 12 months |
| Engagement, findings and report records | Life of the workspace, then 24 months (evidence and dispute purposes) |
| Payout, invoice and tax records | 7 years, or the statutory period where longer |
| Identity and KYB/KYC verification material | As long as required by anti-money-laundering law after the relationship ends |
| Security, audit and access logs | 12 months, except records of an incident, which are kept until the incident is closed and its findings are actioned |
| Support tickets | 24 months |
| Optional marketing consent records | Until withdrawn, then the fact of withdrawal for 24 months |
| Backups | Roll off on the schedule above; deleted data may persist in backups for up to 35 days |
When a retention period ends we delete or irreversibly anonymise the data.
9. How we protect it
Encryption in transit and at rest; role-based access with least privilege and mandatory multi-factor authentication for administrative access; segregation of customer workspaces; audit logging of privileged actions; secrets management and key rotation; hardened, patched infrastructure; dependency and vulnerability management; monitoring and alerting; tested backup and restoration; and annual review of access rights.
If a personal data breach occurs, we contain it, notify the Privacy Owner within 24 hours, notify the competent authority within 72 hours where the law requires it, and notify affected customers without undue delay where there is a risk to their rights.
10. Children
Our services are for organisations and professional users. They are not directed to children, and we do not knowingly collect data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.
11. Automated decisions
We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Ranking, scoring and AI-assisted summaries inform human decisions; they do not replace them.
12. Changes to this policy
We review this policy at least annually and whenever our processing changes materially. Material changes are announced in the workspace and by email before they take effect, and the version and effective date at the top of this page are updated.
13. Contact
Privacy enquiries and data subject requests: privacy@axumsec.com Security disclosures: security@axumsec.com Postal: AXUM SEC Technology PLC, Addis Ababa, Ethiopia (attention: Privacy)