Privacy Policy

Kritis is operated by CTRL 18 Private Limited (“CTRL 18”, “we”, “us”), a company incorporated in India with its registered office at 249, 2nd Main, 2nd Cross, Domlur 2nd Stage, Domlur, Bengaluru 560071, Karnataka, India and corporate identity number U58201KA2026PTC225545.

This policy explains what information we collect through kritis.io and the Kritis platform, why, and what choices you have.

For your account details and your use of our website, we decide how the information is used. Under India's Digital Personal Data Protection Act, 2023 we are the Data Fiduciary for it (the “controller” under the GDPR).

For information Kritis reads from systems your organisation connects, such as Microsoft Entra ID, Microsoft 365, Azure, AWS or your firewalls, we act on your organisation's instructions as a Data Processor. Your organisation decides what to connect, and its own privacy notice applies to its people. If you are an employee of one of our customers and have questions about that information, contact your organisation first; we will help it respond.

• Account information: your name, work email address, organisation, role, and your password (stored only as a one-way hash) and multi-factor authentication settings.
• Usage information: pages you visit in Kritis, times, browser type, IP address and a session identifier, collected by our own first-party analytics. We honour your browser's Do Not Track setting.
• Information you enter: assessment answers, notes, documents you upload, and business figures such as revenue or sector that you provide for risk estimates.
• Information from systems you connect, read with the read-only access you grant: security settings and configuration; directory information such as user names, email addresses, roles, group memberships, sign-in activity and multi-factor registration status; device names and compliance state; cloud resource names and settings; and network and firewall configuration. Kritis does not read email, file or chat content, and does not read the values of secrets, keys or passwords stored in your systems.
• External scan information: for domains you ask us to scan, public information such as DNS records, certificates, web server headers, exposed services and publicly reported breaches.
• Communications: messages you send us, for example support requests.

• To provide Kritis: run the scans and assessments you ask for, and produce scores, findings, risk estimates and reports.
• To keep accounts and the service secure, including detecting misuse.
• To send service emails, such as sign-in and password messages and the alerts you choose to receive.
• To support you and to improve and fix the service.
• To meet legal obligations.

We do not sell personal data, use your organisation's data for advertising, or use it to train artificial intelligence models.

Some features write plain-language summaries of your results. To do this we send the relevant findings, such as domain names, detected technologies and vulnerabilities, to our AI model provider (listed in section 6). We do not send passwords or access credentials. The provider processes this information only to return the summary and, under its terms, does not use it to train its models.

We use these providers to run Kritis. Each processes information only to provide its service to us.

Kritis also downloads public vulnerability data (for example from the U.S. National Vulnerability Database, GitHub security advisories and VulnCheck). We send none of your information to those sources. We will update this list before adding a provider that processes your information.

Kritis is hosted in Germany. Service emails are sent from India, and some providers in section 6 are in the United States and Australia. Where information leaves India or the European Economic Area, we transfer it as the applicable law allows, including EU Standard Contractual Clauses where required.

• Account information: while your account is active.
• Your organisation's data, including scan results and information from connected systems: for the length of the subscription, then deleted within 30 days of it ending, or sooner if your organisation asks.
• Backups: overwritten within 30 days.
• Usage and security logs: up to 12 months.

• All traffic to Kritis is encrypted in transit (HTTPS).
• Credentials for connected systems, such as API keys, are encrypted at rest. Microsoft and AWS connections use read-only access your administrators grant, so we never hold their passwords.
• Each organisation's data is kept separate, enforced in the database itself.
• Multi-factor authentication is available for every account, and sign-ins and changes are logged.

No system is perfectly secure. If a personal data breach affects you, we will notify you, your organisation and the authorities as the law requires.

Depending on where you are, you can ask to access, correct or erase your personal data, withdraw consent where we rely on it, and raise a grievance. Under the Digital Personal Data Protection Act, 2023 you may also nominate someone to exercise these rights for you. If you are in the European Economic Area or the United Kingdom, you can also object to or restrict processing, ask for a copy in a portable format, and complain to your data protection authority.

To use any of these rights, email hello@ctrl18.com. For information from your organisation's connected systems, we will pass your request to your organisation.

Kritis keeps your sign-in session in your browser's local storage and uses our own first-party analytics, as described in section 3. We do not use third-party advertising or tracking cookies.

Kritis is a business service and is not meant for anyone under 18. We do not knowingly collect children's data.

We will post any change here with a new date. If a change is significant, we will tell account administrators by email or in Kritis before it takes effect.

Grievance Officer, CTRL 18 Private Limited, 249, 2nd Main, 2nd Cross, Domlur 2nd Stage, Domlur, Bengaluru 560071, Karnataka, India. Email hello@ctrl18.com. We acknowledge a grievance within 7 days and resolve it within 30 days.

You can also read our Terms of Service.