App Privacy Policy
- Who we are
- What Google user data we access
- How we use Google user data
- Limited Use disclosure
- Automated and AI-assisted processing
- Who we share Google user data with
- International transfers
- How we protect Google user data
- Retention and deletion
- Your rights and how to revoke access
- Controller / processor roles
- Changes to this notice
- Contact us
1. Who we are
Ciso99.AI ("Ciso99.AI", "we", "us") provides an AI-assisted security and compliance platform that helps organizations monitor their security posture, detect and investigate incidents, manage vulnerabilities, and automate compliance evidence collection.
This App Privacy Policy explains specifically how the Ciso99.AI application accesses, uses, stores, shares, and deletes Google user data obtained through Google Workspace and Google APIs. It supplements our Company Privacy Policy and our Data Processing Agreement. Where this App Privacy Policy and the Company Privacy Policy differ with respect to Google user data, this notice controls.
Ciso99.AI is the developer and the organization responsible for the application. Our platform is available at ciso99.ai.
2. What Google user data we access
Ciso99.AI requests the minimum Google OAuth scopes necessary to deliver the security features you enable. We request access only after you, or an administrator of your Google Workspace domain, explicitly grant it on the Google consent screen. Nothing is accessed before that grant.
What we access
Ciso99.AI accesses administrative and directory metadata from your Google Workspace — the information required to establish who has access to what, and whether that access is appropriate. At a high level, this comprises:
| Category | What it covers |
|---|---|
| Accounts | User accounts and their attributes — name, email address, aliases, suspension and administrator status, organizational unit, and creation and last-login timestamps. |
| Groups and membership | Groups, their members, and Cloud Identity groups — the access an account holds by virtue of belonging to a group. |
| Privilege | Administrator roles and role assignments, used to identify privileged accounts and excessive administrative access. |
| Organizational structure | Organizational units, and the domains and domain aliases registered to the account — used to scope reviews and to distinguish internal accounts from external collaborators. |
| Account security settings | Per-user two-step verification (MFA) enrollment and enforcement status; the third-party applications a user has granted access to and the scopes granted; and whether application-specific passwords have been issued. No password, secret, or token value is ever read. |
| Administrative audit and usage records | Admin console audit and usage reports — account activity and changes to security settings — used to evidence that controls operated throughout an audit period and to surface dormant or anomalous accounts. |
| Security policy configuration | Cloud Identity security policy settings, assessed against compliance requirements. |
Read-only, and administrative metadata only. Every scope we request is read-only: Ciso99.AI cannot create, modify, or delete anything in your Workspace. We do not request access to Gmail, Google Drive, Calendar, or Chat, and we never receive the content of any message, document, spreadsheet, or attachment. None of the scopes we request is classified by Google as a restricted scope.
Related data we process
Alongside Google user data, and only where you connect the relevant system, the platform processes equivalent administrative and configuration metadata from the other providers you choose to connect — currently Amazon Web Services, Google Cloud, and GitHub. In each case this comprises identity and access data (accounts, groups, roles, and permission assignments), security configuration settings, and audit records. We also process the names and email addresses of users who sign in to the Ciso99.AI console, together with a record of the actions they take in the platform.
We do not process the content of your files, messages, source code, or customer data. The platform exists to answer the question "who has access to what, and is that appropriate" — which requires permission and configuration metadata, not the material those permissions protect.
3. How we use Google user data
We use Google user data solely to provide and improve the user-facing features you have enabled. Specifically:
- Security monitoring and threat detection — correlating metadata signals to surface phishing, account takeover, and data-exposure indicators.
- Incident detection, investigation, and response — building event timelines and scoping affected accounts and assets.
- Identity and access analysis — reviewing permissions and sharing settings to flag excessive or stale access.
- Compliance automation — generating access-review and control evidence for frameworks such as SOC 2 and ISO 27001.
- Risk and posture management — prioritizing findings and producing remediation guidance.
- Reporting and analytics — presenting dashboards and reports to authorized users within your organization.
What we never do
- We do not sell Google user data to anyone, ever.
- We do not transfer Google user data to data brokers or information resellers.
- We do not use Google user data for advertising of any kind — including targeted, personalized, retargeted, or interest-based advertising.
- We do not use Google user data for credit-worthiness determination or lending purposes.
- We do not use Google user data to build or enrich standalone databases or profiles unrelated to the services you enabled.
- We do not use Google user data to train, fine-tune, or otherwise develop generalized or general-purpose AI or machine learning models.
4. Limited Use disclosure
Ciso99.AI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In practice, this means we limit our use of Google user data to providing or improving user-facing features that are prominent in the Ciso99.AI interface; we do not transfer Google user data except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with user notice and consent; we do not use Google user data for serving advertisements; and we do not allow humans to read Google user data unless we have your affirmative agreement for specific messages or files, it is necessary for security purposes (such as investigating abuse), it is required to comply with applicable law, or the data is aggregated and anonymized for internal operations.
5. Automated and AI-assisted processing
The Ciso99.AI platform uses automated analysis, including generative AI and AI agents, to analyze security signals, correlate events, and generate findings and remediation recommendations. Where Google user data is involved:
- No model training. We do not use Google user data — or any customer personal data — to train, fine-tune, or otherwise improve generative AI models, unless the customer has expressly authorized this in writing for their own data. We do not authorize our AI sub-processors to train on it either.
- Policy-bound execution. AI agents run within defined policy boundaries and cannot take unrestricted actions on connected systems.
- Human oversight. Human-in-the-loop review is available and can be configured as mandatory for critical or high-impact actions.
- Auditability. Agent decisions and actions are recorded in full audit logs available to your administrators.
- Aggregated insights. We may use aggregated and/or anonymized data derived from platform activity to improve the service. Such data cannot be attributed to any individual or organization and is not Google user data.
6. Who we share Google user data with
We do not transfer or disclose Google user data to third parties for any purpose other than providing or improving the features you have enabled. We share it only with:
| Sub-processor | Why we use it | What it does with Google user data |
|---|---|---|
| Google Cloud Platform | Infrastructure — we do not run our own data centres. | Hosts the entire platform: application compute, the tenant database, and file storage. All Google user data we retain is stored here, encrypted at rest, in the europe-west3 (Frankfurt) region. |
| Google Cloud Vertex AI | Model inference — findings are summarized and remediation drafted by a language model rather than hand-written. | Receives only the specific content needed for a given request, as input for that request alone. It is not retained by the provider and is never used for model training. Inference currently runs at a global endpoint and is therefore not pinned to the EU — see section 7. |
| Anthropic | Model inference — same purpose, for the models we run on Anthropic's API. | Receives only the content needed for a given request, under contractual terms prohibiting retention for model training. |
| Slack Technologies | Delivery — reviews and findings are conducted in the customer's own Slack, not in a separate console the reviewer must log into. | Where a customer has connected Slack, receives the review requests, findings, and campaign messages we send into their own workspace. Reviewers make their access decisions there, so the content of those cards passes through Slack. |
| Descope | Authentication — we do not build or store our own password infrastructure. | Authenticates users signing in to the Ciso99.AI console. Receives names, email addresses, and authentication metadata only — never Google user data. |
| Your own organization | — | Authorized administrators and users within your tenant, according to the role-based permissions you configure. |
| Legal and regulatory recipients | — | Where disclosure is required by applicable law, legal process, or to protect rights and safety. We notify you where legally permitted. |
Every sub-processor undergoes security due diligence and risk assessment, is bound by a written data processing agreement with confidentiality and security obligations at least as protective as those we owe you, and may process Google user data only on our documented instructions. Ciso99.AI remains fully responsible to you for its sub-processors' performance. The list above is current as of the "Last updated" date at the top of this page. We revise it whenever we add or replace a sub-processor, and we notify customers in advance of material changes.
We do not sell Google user data, and we do not share it for cross-context behavioral advertising.
7. International transfers
Ciso99.AI is established in Israel, and data may be processed in Israel, the European Economic Area, the United States, or other regions where our infrastructure and sub-processors operate. Where Google user data is transferred across borders, we implement appropriate safeguards — including contractual data protection commitments equivalent to those in this notice, encryption in transit, and, where applicable, Standard Contractual Clauses or equivalent transfer mechanisms. Recipients are bound by the same obligations set out here.
8. How we protect Google user data
We maintain technical and organizational security measures appropriate to the sensitivity of the data, including:
- Encryption — TLS 1.2 or higher in transit; AES-256 or equivalent at rest. Secrets are managed in a dedicated vault; no hardcoded credentials.
- Access control — role-based access control, least-privilege enforcement, multi-factor authentication for all privileged access, and just-in-time access where applicable. Access to Google user data is restricted to personnel with a documented need to know, all of whom are bound by confidentiality obligations.
- Tenant isolation — logical separation between customers through multi-tenancy controls.
- Monitoring and logging — centralized, immutable-where-feasible logging of access, processing, and security events, with continuous anomaly monitoring.
- Vulnerability management — continuous scanning, structured patch management, and regular penetration testing.
- Incident response — a formal incident response plan with breach detection, escalation, and forensics capability. We notify affected customers without undue delay upon becoming aware of a personal data breach.
- Resilience — backup and disaster recovery procedures with defined RTO/RPO targets.
- Secure development — secure SDLC practices, code review, automated testing, infrastructure-as-code controls, and hardened system baselines.
- Assurance — periodic internal audits, security awareness training, and we are working toward SOC 2 Type II certification.
9. Retention and deletion
- We keep Google user data only for as long as needed to provide the features you have enabled, or where applicable law requires otherwise.
- Revoking the Ciso99.AI connection or disabling an integration stops all further access to Google user data immediately.
- Deletion of Google user data, including on termination of the service, is governed by the customer agreement and the Data Processing Agreement incorporated within it. Deletion is performed using secure deletion procedures.
- You may request deletion at any time through the in-product data management settings, or by contacting us using the details in section 13.
10. Your rights and how to revoke access
Revoking access. You can disconnect Ciso99.AI at any time — from the integrations page inside the product, or directly in your Google Account at myaccount.google.com/permissions. Google Workspace administrators can revoke domain-wide access from the Admin console under Security → API controls. Revocation takes effect immediately.
Data subject rights. Depending on your jurisdiction, you may have the right to access, correct, delete, restrict, or object to the processing of your personal data, and to data portability. Because Ciso99.AI generally processes Google user data on behalf of your organization, please direct such requests to your organization in the first instance; we support our customers in responding, and we provide APIs and processes for access, correction, and deletion requests. You may also contact us directly at privacy@ciso99.ai and we will route your request appropriately.
11. Controller / processor roles
For Google user data accessed through your organization's Workspace domain, your organization is the controller (the party controlling the database) and Ciso99.AI acts as a processor and outsourced service provider on its behalf, under our Data Processing Agreement. We process Google user data only on your documented instructions, except where processing is required by law — in which case we inform you first, unless the law prohibits it. Our processing is governed by the Israeli Protection of Privacy Law, 1981 and the Protection of Privacy Regulations (Data Security), 5777-2017, together with any other applicable data protection laws.
12. Changes to this notice
We will update this notice whenever we change how the Ciso99.AI application accesses, uses, stores, or shares Google user data — including if we request additional Google OAuth scopes. Material changes are announced in-product and by email to account administrators before they take effect, and the "Last updated" date at the top of this page is revised. Where a change materially expands our use of Google user data, we will seek renewed consent.
13. Contact us
Questions about this notice or about how we handle Google user data:
- Company Name: CISO99
- Email: hello@ciso99.ai
- Address: 64 Hagefen, Aseret, Israel, 7685800