Guard privacy policy
Personal-data categories, purposes, legal bases, recipients, international transfers, retention, and individual rights for Guard.
Last revised: October 23, 2026
This Privacy Policy ("Notice") describes how Solarius B.V. ("Solarius") processes personal information in Guard about account users, business contacts, service visitors, support correspondents, and people whose information is processed through the service. Contact dpo@solarius.me for privacy matters and legal@solarius.me for the provider's registered-address and contractual details. For purposes of this Notice, personal information includes information relating to an identified or identifiable individual under applicable data-protection law. This Notice provides transparency about processing; it does not constitute blanket consent or vary an accepted data-processing agreement.
Who decides how information is used
Solarius acts as controller for its business relationship, account administration, billing, communications, and the proportionate security records needed for its own service operations. Solarius acts as processor, or as an authorized subprocessor, for personal information in customer data processed on the customer's instructions. The Data Processing Addendum defines that relationship. A customer's configuration does not make Solarius the controller of every employee or end-user record it holds.
The customer controls its purposes, users, collection settings, integrations, publication, and retention within the service scope. An organization administrator can see membership and activity allowed by their role. Contact the relevant customer for requests concerning its dataset; Solarius helps the customer meet its obligations and does not give an unrelated requester access to its records.
Information categories and sources
The following categories identify the source and purpose of information processed through Guard:
| Category | Examples and source | Main use |
|---|---|---|
| Account and identity | Name, work email, organization, role, authentication and recovery records; supplied by you, your administrator, or your chosen identity provider | Sign-in, membership, authorization, recovery, and account protection |
| Business and billing | Payer name and address, tax identifiers, purchased quantities, invoices, transaction references and payment outcomes; supplied by business contacts and payment providers | Contract administration, payment collection, accounting, and fraud prevention |
| Service interaction | IP address, browser or client details, request time and ID, security events, and administrative activity; generated through use | Service delivery, reliability, security, abuse investigation, and audit |
| Support and correspondence | Contact information, messages, attachments, incident context, and correspondence history; supplied by the requester | Investigating and answering the case and maintaining an accountable record |
| Product customer data | asset and endpoint inventory, device and user identifiers, process and network events, protected traffic, scan credentials, vulnerability findings, detections, incident records, response approvals, quarantined artifacts, evidence, and reports; supplied by customers, their users, configured collectors, targets, and integrations | Contracted Guard operations under customer instructions |
| Preferences and communications | Notification choices, consent or objection records, subscription preferences, and delivery outcomes | Respecting choices and sending requested or required communications |
Payment providers collect payment credentials through their own payment flows. Solarius uses payment references and outcomes for billing; do not send full card details, payment authentication codes, or unrelated identity documents in a support ticket. Information obtained from an enabled directory, security feed, or other integration remains limited to the integration's stated purpose and permissions.
Guard telemetry, traffic, and employee information
Guard processes configured endpoint and network observations, access and posture events, threat indicators, assessment results, and incident evidence. Depending on enabled channels and lawful configuration, evidence can include filenames, user identifiers, addresses, process details, message or document excerpts, quarantined files, and protected HTTP content. These capabilities do not imply continuous recording of every employee action.
Traffic inspection is limited to routed protected traffic and supported protocols. Encrypted HTTP content is available for WAF inspection only when TLS is terminated for that purpose. Endpoint content collection and DLP depend on enabled platform capabilities and policy. Customers must select necessary categories, inform affected people, restrict employee-sensitive detail, and set evidence lifetimes.
For self-hosted Guard, local storage remains under the deployment operator's control. DDoS protection uses a Connector and the admitted Solarius edge. Feed synchronization and remote SOC collaboration have separate connections. Remote SOC triage receives only the event categories the organization enables for collaboration; a disconnected installation cannot provide live observations to the remote SOC.
Shared intelligence participation is controlled through the indicator-sharing workflow. Customer evidence, raw employee telemetry, credentials, and personal data must not enter the shared feed. If a submitted indicator or context could identify a person, it must be removed or rejected before distribution. Shared-source withdrawal updates future feeds; it cannot recall previously downloaded exports. See employee monitoring.
Purposes and legal bases for controller activities
Where Solarius acts as controller, it shall process personal information only on a lawful basis applicable to the specified purpose. Article 6(1)(b) GDPR applies to processing necessary to perform a contract with the individual or take requested steps before contracting. For a business customer's employees and representatives, account administration, service reliability, support, and proportionate fraud and abuse prevention generally rely on Article 6(1)(f) GDPR: Solarius's legitimate interests in operating a secure contracted service and administering that relationship. Reliance on legitimate interests requires assessment against the individual's rights and reasonable expectations and does not authorize unrelated collection.
Processing necessary to meet applicable accounting, tax-retention, or binding legal-process obligations relies on the relevant legal obligation, including Article 6(1)(c) GDPR when applicable. Optional communications, tracking, and other activities requiring consent shall begin only after valid consent has been obtained under applicable law. Solarius shall retain evidence of the choice and permit withdrawal without affecting the lawfulness of processing before withdrawal. Customer's instructions do not substitute for Solarius's controller legal basis or Customer's own lawful basis for collection.
Solarius does not sell personal information, share it for cross-context behavioral advertising, or use sensitive personal information to infer unrelated personal characteristics. Solarius does not use customer content to train general-purpose AI models. Solarius can use statistics that no longer identify people or customers to understand capacity and reliability; pseudonymous identifiers remain protected personal data and are not treated as anonymous merely because names were removed.
Who receives information
Access is limited to authorized personnel and contracted providers who need it for the relevant service, support, security, legal, or billing function and are bound by appropriate duties. The DPA governs the customer-data register, review, change notices, and objections; its transfer provisions govern restricted routes. Hosting, communications, payment, identity, and support providers have different roles; not every business supplier is a subprocessor of customer content.
Your administrators and selected recipients receive information within their assigned scope. Your enabled ticketing, storage, notification, identity, or reporting integrations receive the categories needed for the configured action. A provider you independently choose operates under your agreement with it. Public content you choose to publish is available to its audience, including external search and archive services.
Solarius discloses information when a verified, binding legal requirement applies, limited to the required scope and subject to available challenges and customer notice. Solarius can share necessary records with professional advisers bound by confidentiality or with an actual business successor under protections consistent with this notice. A corporate sale does not turn customer data into a general marketing asset.
Locations and international transfers
A selected workload or storage region does not locate every account, support, billing, backup, edge-processing, or integration system. The accepted deployment schedule and subprocessor register identify applicable processing locations and access countries. Solarius does not represent that selecting a region creates universal localization.
Restricted international transfers require a valid mechanism and any necessary supplementary measures before processing begins. Depending on the actual route, that can be a relevant adequacy decision or completed contractual safeguards. A reference to standard contractual clauses does not mean an incomplete transfer schedule is effective. Ask dpo@solarius.me for the relevant safeguards and a copy or meaningful description, subject to lawful redaction.
Retention, security, and incidents
Solarius retains information only for its documented service, security, business, or legal purpose, using the retention and deletion schedule. Product history, raw artifacts, backups, audit records, support cases, and tax records can have different lifetimes. A limited preservation obligation can delay deletion of affected records; it does not authorize new unrelated use. Copies you download or send to your own providers have their own lifecycle.
Solarius uses risk-appropriate access controls, authentication, confidentiality duties, protected transmission, supported encryption, logging, change controls, and recovery arrangements. These safeguards are proportionate to risk and do not constitute a warranty that unauthorized access, loss, or interruption is impossible. Solarius remains subject to its express security commitments and mandatory obligations. Personal-data incidents follow applicable notification law and the DPA; a product alert is not automatically a breach of Solarius systems. Report suspected compromise to help@solarius.me and vulnerabilities through security disclosure.
Your choices and rights
Depending on applicable law and Solarius's role, you can request access and a copy, correction, erasure, restriction, portability, an objection, withdrawal of consent, or an explanation and review of a significant automated decision. You can object to direct marketing at any time. Essential security, contractual, and billing notices can continue because they serve a different purpose. Solarius does not condition service or fair treatment on waiving a statutory privacy right.
Email dpo@solarius.me with the relevant account, product, relationship to the data, and requested action. You can also submit a privacy request through help@solarius.me. Solarius verifies identity and authority proportionately, requests only necessary additional information, and accepts authorized agents subject to lawful verification. Solarius does not routinely require government ID when a less intrusive method is sufficient. Solarius explains a refusal, partial response, fee, or extension when law requires; ordinary requests are free.
For GDPR requests, Solarius responds without undue delay and ordinarily within 1 month. Where legally justified, an extension of up to 2 additional months is explained within the first month. Other jurisdictions' applicable deadlines and appeal routes govern their requests. For customer-controlled information Solarius refers the request to the customer and assists it rather than independently changing its dataset. An organizational data export and an individual's access request are separate scopes.
Solarius does not make decisions about individuals that produce legal or similarly significant effects solely through automated processing for Solarius's own account-administration purposes. Automated defensive checks can restrict suspicious activity; affected users can contact support for human review. Customers using Guard must independently assess their own decision processes, notices, and review duties.
California and other US state rights
Where a state privacy law applies to Solarius's processing, the listed categories describe information collected and disclosed for the listed business purposes during the preceding 12 months, to the extent Solarius operated the service during that period. Solarius does not sell or share it for cross-context behavioral advertising and does not knowingly sell or share information about people under 16. Sensitive information is used only for the requested service and permitted security, legal, or administrative purposes, rather than unrelated inferences.
Eligible residents can request access, correction, deletion, portability, and other applicable rights through the listed request channels without unlawful discrimination. Solarius honors legally required universal opt-out signals for activities to which they apply; such a signal does not disable security or requested service processing. If Solarius denies a request and an appeal right applies, reply to dpo@solarius.me with "Privacy appeal" and the request reference for review. You can also complain to the competent state authority. When Solarius acts as a service provider, requests about the business customer's data are coordinated with that business.
Browser storage, children, and changes
Cookies and browser storage describes necessary sessions, preferences, local storage, and choices for optional technologies. Browser push permission and subscriber confirmation are separate from permission to use optional tracking. The business services are intended for adults acting in a work capacity, not accounts directed to children. If Solarius learns of an account created by a child without a lawful basis, Solarius investigates and takes appropriate protective action. Customer workloads containing children's data require the customer's own lawful basis and appropriate safeguards.
You can complain to your competent supervisory authority, including the Dutch Autoriteit Persoonsgegevens. Contacting Solarius first is optional. Material changes to this notice are communicated directly or through a prominent relevant notice with their effective date. A materially incompatible new purpose requires its own lawful basis, prior transparency, consent when required, and any necessary contractual authority. Revision of this Notice alone shall not authorize that processing or diminish an accrued or mandatory right.