1.0 Scope and who we are
In short: we collect the details you give us when you contact us or use a SOVRINT account, plus the technical records needed to run and secure the service. We do not sell personal data, we do not run advertising or third-party analytics on this site, and the material our customers analyse in the platform is processed on their instructions.
This policy explains how SOVRINT Inc. (“SOVRINT”, “we”, “us”) handles personal data when you visit www.sovrint.com, submit an inquiry or briefing request, correspond with us, or use the SOVRINT platform as an authorized user of a customer workspace.
SOVRINT is the controller of the personal data described in sections 2.1 to 2.3: website records, inquiries and account data. For Customer Content (section 2.4), SOVRINT acts as a processor on behalf of the customer organization that operates the workspace. That processing is governed by our Data Processing Agreement and the customer’s own privacy notices, not by this policy.
2.0 Information we collect
2.1 Information you give us
- Inquiries and briefing requests. When you use the contact or briefing forms we receive your name, work email address, organization, the topic or mission area you select, an optional region and role, your message, and the page the form was submitted from.
- Correspondence. Emails and messages you send us, including security reports sent under our Security Disclosure policy.
- Account data. Platform accounts are created by invitation from a customer workspace. We hold your name, work email address, a salted hash of your password (never the password itself), your role, and the workspace you belong to.
2.2 Information collected automatically
- Request logs. Our hosting provider records the IP address, browser type, requested page, referring page, timestamp and response status of each request so that we can operate, debug and secure the site.
- Abuse controls. The public inquiry endpoint counts submissions per IP address for a short window to limit automated abuse. These counters are held in memory and are not stored as a record of you.
- Cookies and similar storage. We use only strictly necessary sign-in cookies and a small number of preference settings. There are no advertising, tracking or third-party analytics cookies on this site. The full inventory is in our Cookie Policy.
2.3 Platform activity records
Actions taken inside a workspace (for example creating a case, editing a watchlist or exporting a brief) are written to an audit log that records who did what, when, and to which record. Audit logs exist so that customers can account for how their workspace is used and so that we can investigate security incidents.
2.4 Customer Content
Customer Content is the material that a customer and its authorized users add to or generate within their workspace: watchlists, cases, claims, analyst notes, briefs, uploaded files and preserved copies of source material. Because the platform is used to analyse publicly available information, Customer Content can include personal data about third parties, such as the author of a public post or a person named in public reporting. Section 3.0 explains how we approach that material.
3.0 Publicly available information
SOVRINT helps institutions understand how narratives emerge and move across open sources. In doing so, customers direct the platform to collect, preserve and analyse content that is already public. SOVRINT does not use that content to build profiles of private individuals for its own purposes, does not combine it across customers, and does not sell or license it.
Our Acceptable Use Policy prohibits using the platform to harass, stalk, intimidate or discriminate against individuals, or to target people for their lawful expression. Customers are responsible for having a lawful basis for the investigations they run and for honouring the rights of the people whose public content they examine.
If you believe that information about you is held in a customer workspace, contact us at privacy@sovrint.com. Where we can identify the customer concerned we will pass your request to them and assist them in responding; where we act as controller we will respond ourselves.
4.0 How we use information
| Purpose | Data used | Legal basis (EEA and UK) |
|---|---|---|
| Responding to inquiries and briefing requests, and following up on them | Inquiry details, correspondence | Legitimate interests in responding to a request you made; steps prior to a contract |
| Providing the platform: sign-in, authorization, tenant separation and support | Account data, sign-in cookies, audit logs | Performance of the contract with the customer; legitimate interests in operating the service |
| Securing the service and preventing abuse, fraud and unauthorized access | Request logs, abuse counters, audit logs, security reports | Legitimate interests in protecting the service, our customers and the public |
| Meeting legal obligations and responding to lawful requests | Whatever the obligation requires | Legal obligation |
| Informing account holders about material changes to the service or its terms | Account email address | Performance of the contract; legitimate interests |
We contact you about the inquiry you made. We do not add you to marketing lists without asking, and any marketing email includes a way to opt out. We do not make automated decisions about you that have legal or similarly significant effects.
5.0 How we share information
We share personal data only with the parties below, and only to the extent needed for the purposes in section 4.0. We do not sell personal data and we do not share it for cross-context behavioural advertising.
| Recipient | What they receive | Why |
|---|---|---|
| Vercel Inc. (hosting and content delivery, United States) | Request logs and all data that passes through the site and platform | Hosts and serves the website and platform |
| Amazon Web Services, Inc. (cloud storage, United States regions unless a customer’s agreement specifies otherwise) | Preserved source material, uploaded files and platform records | Object and record storage for the platform |
| Managed database hosting provider | Account data, workspace records and audit logs | Hosts the platform database; named in the customer’s agreement and in the DPA sub-processor list |
| Internal inquiry-handling tools | Inquiry and briefing request details | Routes your request to the right member of the team |
| Professional advisers | Only what a matter requires | Legal, accounting and insurance advice |
| Public authorities and courts | Only what the law compels | Complying with binding legal process; protecting rights, safety and the integrity of the service |
| A successor organization | Records relevant to the transaction | If SOVRINT is involved in a merger, acquisition or asset sale, subject to this policy |
Within the platform, your name and email address are visible to other members of your workspace and appear in that workspace’s audit log. Customer administrators control who is invited to a workspace.
6.0 International transfers
SOVRINT is based in the United States and the providers listed above process data there. Where personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum and the Swiss amendments, together with supplementary measures where needed. Customers can obtain a copy of the transfer terms through the Data Processing Agreement.
7.0 How long we keep information
| Data | Retention |
|---|---|
| Inquiries and briefing requests | Up to 24 months after our last contact with you, unless a customer relationship follows |
| Account data | For as long as the account exists, then removed within 90 days of the account or workspace being closed |
| Audit logs | For the life of the workspace, or the period agreed with the customer, then deleted with the workspace |
| Request logs | A short period set by our hosting provider, typically days, unless a specific log is preserved for a security investigation |
| Customer Content | As instructed by the customer and, at termination, returned or deleted in line with the DPA |
| Security reports and correspondence | For as long as needed to resolve the matter and maintain a record of it |
We may keep information for longer where the law requires it, where it is needed to establish or defend legal claims, or where a customer has asked us to preserve it under a legal hold.
8.0 Security
All traffic to the site and platform is encrypted in transit, and connections are pinned to HTTPS. Passwords are stored only as salted hashes. Workspace data is separated by tenant and access inside a workspace is controlled by role. Administrative actions are recorded in audit logs. Public endpoints are rate limited and protected against automated submission. Staff access to production systems is restricted to people who need it to operate the service.
No system is perfectly secure. If you discover a vulnerability, please report it under our Security Disclosure policy. If we learn of a breach affecting your personal data we will notify you and any relevant authority as the law requires.
9.0 Your rights
Depending on where you live, you may have the right to ask us to confirm whether we hold personal data about you and to give you a copy of it; to correct inaccurate data; to delete it; to restrict or object to particular processing; to receive data you provided in a portable form; and to withdraw consent where consent is the basis for processing. You also have the right to complain to your data protection authority. In the EEA and UK this is the authority in the country where you live or work.
If you are a California resident, the California Consumer Privacy Act gives you the right to know what personal information we collect and how it is used and disclosed, to delete it, to correct it, and to not be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined in California law, so there is nothing to opt out of. You may use an authorized agent to make a request on your behalf.
To exercise any of these rights, email privacy@sovrint.com. We will verify your identity, which may involve confirming control of the email address we hold for you, and respond within the time the applicable law allows. Where the data you ask about is Customer Content held in a customer workspace, we will refer your request to that customer, who is responsible for responding.
10.0 Children
The website and platform are intended for institutional use by adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.
11.0 Changes to this policy
We will post any changes on this page and update the date at the top. If a change materially affects how we use personal data, we will notify account holders by email before it takes effect.
12.0 Contact
Privacy questions and requests: privacy@sovrint.com. You can also reach the team through the contact page. Postal correspondence can be addressed to SOVRINT Inc. at the address provided in your customer agreement.