home features pricing install docs contact

Privacy Policy

$ cat /etc/shellarmor/privacy.conf

Last updated: April 24, 2026

This Privacy Policy describes how Averta Security ("we", "us", "our") collects, uses, stores, and protects information when you use the ShellArmor platform ("the Service"). By using the Service, you consent to the practices described in this policy.

1. Information We Collect

Account information: When you register, we collect your name, email address, organization name, and billing information (payment details are processed and stored by our payment providers, not on our servers).

Agent telemetry: The ShellArmor agent installed on your servers collects security-relevant data including:

  • SSH session metadata — source IP addresses, usernames, login timestamps, session duration, and authentication method used.
  • Command patterns — commands executed within SSH sessions are analyzed for threat scoring. Commands are processed in real time for scoring and policy enforcement. Session recordings (Enterprise plan) store the full PTY stream in encrypted, hash-chained format.
  • Security events — authentication failures, blocked IPs, threat scores, policy violations, file integrity alerts, and lateral movement detections.
  • System information — operating system, kernel version, agent version, CPU/memory usage, and running services (for fleet health monitoring).
  • SSH configuration — sshd_config settings, authorized keys metadata (fingerprints, not private keys), and key file permissions.

The agent never collects or transmits: private SSH keys, passwords, environment variables, file contents (beyond SSH configuration files), or data from non-SSH processes.

Dashboard usage: We collect information about how you interact with the dashboard, including pages visited, features used, and actions taken (e.g., blocking an IP, deploying a policy). This helps us improve the user experience.

Website analytics: Our marketing website (shellarmor.com) collects standard analytics data including pages visited, referral source, browser type, and approximate geographic location. We use privacy-respecting analytics and do not track individual users across websites.

Support communications: When you contact us for support, we collect the content of your messages, email address, and any attachments you provide.

2. How We Use Your Information

We use collected information for the following purposes:

  • Providing the Service: Processing agent telemetry to generate alerts, threat scores, dashboards, reports, and policy enforcement actions.
  • Security operations: Detecting threats, blocking malicious activity, enforcing security policies, and generating compliance reports on your behalf.
  • Service improvement: Analyzing aggregated, anonymized telemetry patterns to improve our threat detection models and scoring algorithms. We do not use your raw session data to train models — only anonymized, aggregate patterns across all customers.
  • Account management: Processing payments, sending invoices, managing your subscription, and authenticating your access.
  • Communications: Sending service notifications (security alerts, maintenance windows, policy changes), product updates, and responding to support requests. We do not send marketing emails unless you opt in.
  • Legal compliance: Meeting legal obligations, responding to lawful requests from authorities, and enforcing our Terms of Service.

3. Data Retention

Security event data (alerts, session logs, threat scores) is retained according to your subscription plan:

  • Free: 30-day hot storage. No cold storage archival.
  • Pro: 90-day hot storage. 1-year cold storage archival.
  • Enterprise: 365-day hot storage. 7-year cold storage archival.

Hot storage provides instant query access through the dashboard. Cold storage archives are compressed, encrypted, and available on request for compliance and forensic purposes.

Account data is retained for the duration of your subscription plus thirty (30) days after termination to allow for data export.

Support communications are retained for two (2) years for quality assurance and reference purposes.

After the applicable retention period, data is permanently and irreversibly deleted from all systems, including backups.

4. Data Storage and Security

We implement multiple layers of security to protect your data:

  • In transit: All data transmitted between the agent and our infrastructure is encrypted using TLS 1.3 with mutual TLS (mTLS) authentication. The agent and dashboard authenticate each other before any data is exchanged.
  • At rest: All stored data is encrypted using AES-256. Session recordings are additionally hash-chained to ensure immutability and tamper-evidence.
  • Access controls: Internal access to customer data is restricted on a need-to-know basis, protected by multi-factor authentication, and logged for audit purposes.
  • Infrastructure: Our infrastructure is hosted in SOC 2 compliant data centers with physical security controls, redundant power, and network isolation.

While we implement industry-standard security measures, no system is completely immune to attack. We cannot guarantee absolute security and encourage you to report any suspected security issues to us immediately.

5. Data Sharing

We do not sell, rent, or trade your personal information or server data to third parties. We share data only in the following limited circumstances:

  • Payment processors: Stripe and PayPal process your payment information. They receive only the billing data necessary to process transactions and are bound by their own privacy policies and PCI DSS compliance.
  • Infrastructure providers: Our hosting and cloud providers store encrypted data on our behalf. They do not have access to decrypted customer data.
  • Legal requirements: We may disclose information if required by law, subpoena, court order, or government request. We will notify you of such requests where legally permitted and will challenge requests we believe are overly broad.
  • Business transfers: In the event of a merger, acquisition, or sale of assets, customer data may be transferred as part of the transaction. We will notify you and provide the opportunity to delete your data before any such transfer.

We do not share your raw server telemetry, session recordings, or security event data with any third party for any purpose other than providing the Service.

6. Cookies and Tracking

Essential cookies: The dashboard uses cookies for authentication, session management, and security (CSRF protection). These cannot be disabled without losing access to the Service.

Analytics: Our marketing website uses privacy-respecting analytics to understand page views and referral sources. No personally identifiable information is collected through analytics.

No third-party trackers: We do not use advertising trackers, social media pixels, or cross-site tracking technologies on any part of the Service.

7. Your Rights

Regardless of your location, we provide the following rights to all customers:

  • Access: You can access all your data through the dashboard at any time. You may also request a complete copy of your data by contacting us.
  • Correction: You can update your account information through the dashboard. For corrections to other data, contact us.
  • Deletion: You can request deletion of your account and all associated data at any time. Deletion is completed within thirty (30) days of your request.
  • Export: You can export your security events, session logs, and configuration data through the dashboard or API in standard formats (JSON, CSV).
  • Objection: You can object to specific processing activities. Where we process data based on legitimate interest, we will cease processing upon objection unless we have compelling grounds.
  • Communication preferences: You can opt out of non-essential communications at any time. Security-critical notifications (e.g., active threat alerts, service disruptions) cannot be disabled while the Service is active.

To exercise any of these rights, use the dashboard settings or contact us. We respond to all requests within thirty (30) days.

8. International Data Transfers

Your data may be processed and stored in data centers located in different regions. When data is transferred across borders, we ensure appropriate safeguards are in place, including standard contractual clauses and encryption of all data in transit and at rest. We comply with applicable data transfer regulations including GDPR requirements for transfers outside the European Economic Area.

9. GDPR Compliance (EEA Users)

For users in the European Economic Area, we process personal data under the following legal bases:

  • Contract performance: Processing necessary to provide the Service you have subscribed to (agent telemetry, dashboard access, alerting).
  • Legitimate interest: Improving our threat detection capabilities using anonymized, aggregate data; ensuring Service security and preventing abuse.
  • Consent: Marketing communications (where applicable). You may withdraw consent at any time.
  • Legal obligation: Processing required to comply with applicable laws.

EEA users have additional rights under GDPR including the right to lodge a complaint with a supervisory authority in their member state.

10. CCPA Compliance (California Users)

Under the California Consumer Privacy Act, California residents have the right to: know what personal information we collect and how we use it; request deletion of personal information; opt out of the sale of personal information (we do not sell personal information); and not be discriminated against for exercising these rights. To exercise your CCPA rights, contact us.

11. Children's Privacy

ShellArmor is a business-to-business security service not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 18, we will delete that information promptly.

12. Data Breach Notification

In the event of a data breach that compromises your personal information or server data, we will:

  • Notify affected customers via email and dashboard notification within seventy-two (72) hours of becoming aware of the breach.
  • Provide details of what data was affected, what actions we are taking, and what steps you should take to protect yourself.
  • Notify relevant supervisory authorities as required by applicable law.
  • Publish a post-incident report detailing the root cause and remediation measures.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes via email and dashboard notification at least thirty (30) days before the changes take effect. The "Last updated" date at the top of this page indicates when the policy was last revised. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

14. Contact

For privacy-related questions, data requests, or concerns, contact us.

If you believe your privacy rights have been violated, you have the right to lodge a complaint with your local data protection authority.