Privacy Policy

1Introduction

About FortiVox

FortiVox is a cloud-delivered cybersecurity platform that protects websites and applications with adaptive AI, a managed Web Application Firewall (WAF), DDoS mitigation, edge IP filtering, and global threat intelligence. Customer traffic is routed through our edge nodes where it is inspected, classified and either delivered to the origin or blocked.

Purpose of this Policy

This policy describes the personal, account, technical and security-event data that the platform collects to provide the Service, how that data flows through our systems, who it may be shared with, and how long it is retained. It is written to be practical and specific to FortiVox — not a generic template.

User Agreement

By creating an account, connecting a website, or otherwise using the FortiVox platform, you acknowledge that you have read and accepted this Privacy Policy. If you do not agree with any part of this policy, you must stop using the Service.

2Information We Collect

We collect only the data needed to operate, secure and bill the platform. The categories below describe what is stored in our database tables.

Account & Company Information

• Account information — username, hashed password, role and account status.
• Company information — company name, billing entity and country.
• Contact details — primary contact name and phone number provided during registration.
• Email addresses — used for sign-in, security notifications, billing and support correspondence.

Protected Asset Information

• Website information — every domain added to FortiVox, including its plan, status and ownership.
• DNS configuration information — the A records, edge-IP verification results and DNS-check history we record while validating that traffic flows through our edge.
• Threat and security logs — events generated by the WAF, AI engine and rate-limiting layer for each connected website.
• Support ticket information — the messages, attachments and metadata you submit through the support system.

3Security and Threat Data

To detect and stop attacks, the platform inspects traffic destined for protected websites and records security-relevant events. This data is the operational heart of the Service.

• Attack events — every request blocked or flagged by the WAF or AI engine is recorded with timestamp, severity and the rule that triggered it.
• Threat intelligence records — IP reputation, country of origin, threat category and observed attack patterns aggregated from our edge network.
• Blocked IP information — IP addresses placed on per-site or global block lists, with the reason and the admin or automated rule that added them.
• WAF events — request payloads, headers and matched signatures associated with WAF rule hits, retained for forensic review.
• Security monitoring records — audit-style entries showing how each connected site is being defended over time.

4Phishing Simulation & Security Awareness Testing

FortiVox provides phishing simulation and security awareness testing services to help organizations identify vulnerabilities and improve employee security awareness. These services are conducted with strict ethical guidelines and security controls.

Purpose and Authorization

Phishing simulations are designed exclusively for:

• Security awareness training — educating employees about phishing threats and social engineering tactics.
• Vulnerability assessment — identifying organizational weaknesses in email security and user behavior.
• Compliance requirements — meeting regulatory standards such as ISO 27001, PDPL, and cybersecurity frameworks.
• Security posture improvement — closing security gaps and strengthening organizational defenses against real phishing attacks.

Domain Ownership Verification

Before any phishing simulation campaign can be launched, we require strict verification of domain ownership through DNS verification:

• DNS TXT record verification — clients must add a unique verification token to their domain's DNS settings to prove ownership.
• Authorization confirmation — only authorized administrators who control the domain DNS can request phishing simulations.
• No unauthorized testing — campaigns cannot target domains that have not been verified and explicitly authorized.

Data Collected During Simulations

During phishing simulations, we collect the following information for training and reporting purposes only:

• Email interaction data — whether emails were opened, links were clicked, or credentials were submitted (test credentials only).
• Employee information — name, email address, department, and position as provided by the client in CSV format.
• Technical metadata — IP addresses, browser information, and timestamps of interactions for tracking purposes.
• Behavioral patterns — aggregated statistics on click rates, submission rates, and response times.

Security and Ethical Safeguards

Data Retention for Simulations

Phishing simulation data is retained as follows:

• Campaign results — stored for 12 months to allow clients to track improvement over time and generate historical reports.
• Employee interaction records — retained for the duration of the client relationship and purged within 30 days of account closure.
• Anonymized statistics — may be retained indefinitely for research and service improvement, with all personally identifiable information removed.

Client Control and Transparency

Clients have full control over phishing simulation campaigns:

• Campaigns can only be initiated by verified client administrators with proper authorization.
• Clients select templates, target lists, and scheduling for all simulations.
• All results and reports are accessible exclusively to the client organization.
• Clients can request deletion of simulation data at any time through the platform or support channels.
• We never share simulation results with third parties without explicit written consent.

5Visitor and Technical Information

When a visitor reaches a website protected by FortiVox, the platform receives the same technical information any web server would receive in order to deliver and secure the response.

• IP addresses — used for security analysis, geographic filtering, rate limiting and abuse mitigation.
• Browser information — the User-Agent string and related request headers.
• Device information — broad device class derived from the User-Agent (desktop, mobile, bot).
• Operating system — broad OS family derived from the User-Agent.
• Cookies and session data — strictly-necessary cookies used to keep account holders signed in and to protect forms against CSRF attacks. We do not use third-party advertising cookies.

6How We Use Information

The data described above is used exclusively for the following purposes:

• Account management — authenticating users, managing roles and keeping account records up to date.
• Security monitoring — observing the health and security posture of every connected website.
• Threat detection — running rules and AI models to identify malicious traffic in real time.
• Service improvement — improving WAF rules, AI models and detection accuracy using aggregated, anonymised event data.
• Customer support — responding to support tickets and investigating reported incidents.
• Billing and invoicing — generating invoices, recording payment proofs and activating subscriptions.
• Service notifications — sending operational, security and billing notifications to the email on file.

7Data Storage and Protection

• Encryption practices — all traffic to the FortiVox dashboard and APIs is delivered over TLS. Passwords are stored as one-way bcrypt hashes; they are never stored in clear text.
• Access controls — administrative access is restricted by role, protected with CSRF tokens, and every privileged action is written to a tamper-evident audit log.
• Security monitoring — our own infrastructure is monitored using the same threat-intelligence and audit-logging tools we operate for customers.
• Data retention policies — each category of data has a defined retention window (see Data Retention).

8Sharing of Information

We do not sell personal information. We share data only in the limited situations listed below.

• Service providers — vetted infrastructure providers (hosting, email delivery, payment processing) that act on our instructions under written agreements.
• Legal obligations — when required to comply with applicable law, a valid court order, or a government request enforceable in our jurisdiction.
• Fraud prevention — to investigate and prevent fraudulent activity targeting FortiVox or our customers.
• Security investigations — with affected parties, law-enforcement bodies or CERT teams while responding to a security incident.

9Billing and Payment Policy

• Subscription services — paid plans are billed per the cycle shown at sign-up (monthly, yearly or one-time). The price displayed at checkout is the price you pay.
• Manual bank-transfer payments — FortiVox currently accepts payment by bank transfer. The bank details required to complete a payment are shown on the invoice page.
• Invoice generation — an invoice is generated automatically when a paid plan is selected. Each invoice records the plan, billing cycle, amount, currency and (if a promotion is active) the original price and discount amount at the moment of issue.
• Payment verification process — once you upload a proof of payment, the invoice enters Awaiting Review. Our team verifies the transfer, approves or rejects the proof, and on approval the subscription is activated and the corresponding service period is recorded.

10Refund Policy

• Refund requests must be submitted through the Support Tickets system inside your account — refund requests sent through other channels will not be processed.
• Each request is reviewed individually based on the recorded service usage, the invoice history and the surrounding audit-log entries.
• FortiVox reserves the right to approve or reject a request based on service usage, indicators of fraud, or violations of this policy or the user agreement.
• Approved refunds are processed after review and credited using the same payment method that was used to pay the original invoice.

11Support and Disputes

• All billing and service disputes must be opened through Support Tickets.
• Support tickets are the official communication channel between you and FortiVox — they create a permanent, timestamped record that both parties can refer back to.
• Conversations conducted outside the ticket system (such as informal chat) are not considered binding for the resolution of a dispute.

12Terms of Use

Eligibility and authority

You must have legal capacity to enter into a binding agreement under the laws applicable to you. If you use the Service for a company, government body or other organisation, you represent that you are authorised to accept these terms on its behalf. A parent or legal guardian must supervise any use permitted for a minor.

Accounts and access credentials

You are responsible for all activity under your account, for maintaining accurate and current information, and for protecting passwords, API keys, access tokens, recovery codes and administrator devices. You must promptly notify support of suspected compromise or unauthorised use. We may require identity, domain ownership or payment verification before enabling sensitive features.

Licence and permitted use

FortiVox grants you a limited, non-exclusive, non-transferable and revocable right to access and use the Service during your valid subscription solely for your internal lawful purposes and in accordance with plan limits, documentation and these terms. No ownership rights are transferred to you.

You may use security scanning, monitoring, WAF, phishing simulation, threat intelligence, VPN, API and related tools only for systems, domains, networks, personnel and data that you own or are expressly authorised to assess or protect. You are responsible for obtaining all required permissions, notices and consents before testing third-party systems or individuals.

Subscriptions, renewals and service limits

Paid access is governed by the plan, price, billing cycle, quotas and features displayed when you order. Unless the order states otherwise, renewal requires payment for the next period. Taxes, bank charges and currency conversion costs are your responsibility where applicable. Failure to pay may cause restriction or suspension without waiving amounts already due. Refunds are governed by the Refund Policy above and mandatory consumer rights remain unaffected.

Customer content and security data

You retain ownership of content, configurations, domains and data you lawfully submit to the Service. You grant FortiVox a limited licence to host, copy, transmit, inspect and process that material only as reasonably necessary to provide, secure, support and improve the Service, comply with law and enforce these terms. You represent that you have all rights required to provide that material.

Intellectual property

The Service, software, interfaces, designs, documentation, trademarks, reports, detection logic and other platform materials are owned by or licensed to FortiVox and are protected by applicable intellectual-property laws. Except where law expressly permits it, you may not copy, resell, sublicense, reverse engineer, decompile, scrape, frame, remove notices from or create derivative works from the Service, nor use our names or marks without prior written permission.

Third-party services

The Service may interoperate with payment providers, cloud infrastructure, domain registries, threat-intelligence sources, application stores and other third parties. Their products are governed by their own terms and privacy notices. We are not responsible for third-party content, availability, security or acts, but this does not limit any responsibility that cannot legally be excluded.

Service changes, availability and beta features

Cybersecurity services evolve continuously. We may update, replace, restrict or discontinue features to address threats, legal requirements, third-party changes or operational needs. We do not guarantee uninterrupted or error-free availability, complete detection of every threat, or compatibility with every environment. Preview or beta features may be changed or withdrawn and are provided for evaluation unless expressly stated otherwise.

Suspension and termination

You may stop using the Service or request account closure at any time, subject to outstanding payment obligations and applicable retention requirements. We may limit, suspend or terminate access where reasonably necessary for non-payment, a security emergency, legal compliance, abuse, risk to others or a material breach. Where practicable and lawful, we will provide notice and an opportunity to remedy the breach. Provisions intended by their nature to survive termination—including payment, intellectual property, disclaimers, liability, indemnity and dispute provisions—will survive.

Security disclaimer

No security product eliminates all risk. Scores, alerts, scan results, recommendations and threat-intelligence outputs are informational and may contain delays, false positives or false negatives. You remain responsible for backups, access controls, updates, incident response, legal compliance and independent professional judgment. Do not rely on the Service as the sole basis for a safety-critical, legal, financial or compliance decision.

Warranties and limitation of liability

To the maximum extent permitted by law, the Service is provided “as is” and “as available” without implied warranties of merchantability, fitness for a particular purpose, non-infringement or uninterrupted operation. FortiVox does not warrant that every attack, vulnerability, malicious link or outage will be detected or prevented.

To the maximum extent permitted by law, FortiVox and its officers, employees, affiliates and suppliers will not be liable for indirect, incidental, special, consequential, exemplary or punitive damages, or for loss of profits, revenue, goodwill, opportunity or data. Their aggregate liability arising from the Service will not exceed the fees you paid to FortiVox for the affected Service during the twelve months before the event giving rise to the claim. These exclusions and limits do not apply where prohibited by law or to liability that cannot legally be limited.

Indemnity

To the extent permitted by law, you will defend and indemnify FortiVox and its personnel against third-party claims, losses and reasonable costs arising from your unlawful use of the Service, your content, your assessment of systems without authorisation, or your material breach of these terms. This obligation does not apply to the extent a claim was caused by FortiVox’s own unlawful conduct.

Governing law and disputes

These terms are governed by the laws applicable at the registered address of the Service operator shown in the Contact Information section, without regard to conflict-of-law rules, unless mandatory consumer or local law requires otherwise. Before filing a formal claim, each party must give the other written notice through the official support channel and allow at least 30 days for a good-faith resolution. Courts with lawful jurisdiction at that registered address will have jurisdiction unless mandatory law provides another forum.

General provisions

These terms, the Privacy Policy, Cookie Policy, order details and any service-specific terms form the entire agreement for the Service. If a service-specific term conflicts with these general terms, the service-specific term controls for that feature. If any provision is unenforceable, it will be limited to the minimum extent necessary and the remainder will continue. Failure to enforce a provision is not a waiver. You may not assign the agreement without written consent; FortiVox may assign it as part of a merger, reorganisation or transfer of the relevant business, subject to applicable law.