1. Scope and Roles
This Privacy Notice describes how DeviceTrust Inc. (“DeviceTrust,” “we,” or “our”) processes information across our public web properties (devicetrustportal.com) and our enterprise endpoint posture verification platform.
When an organization deploys the DeviceTrust platform to verify workforce or contractor endpoints, that organization acts as the Data Controller (or “Business” under CCPA/CPRA), and DeviceTrust acts strictly as a Data Processor (or “Service Provider”) governed by our executed Master Subscription Agreement and Data Processing Addendum (DPA).
2. Cookie-Free Public Website
Our public documentation and informational pages operate without third-party advertising trackers, cross-site behavioral pixels, or persistent marketing cookies. Standard HTTP server access logs (request timestamp, TLS protocol version, and truncated IP address) are retained for a maximum of 14 days strictly for DDoS mitigation and infrastructure reliability.
3. Endpoint Agent Telemetry Minimization
The DeviceTrust verification agent is architected to evaluate hardware security state without intruding on personal employee privacy. Specifically, when authorized by a Customer Administrator, the agent processes:
- Hardware model identifier, operating system version, and security patch build numbers;
- Public cryptographic attestation keys generated inside hardware TPM 2.0 or Secure Enclave modules;
- Boolean and configuration posture states (disk encryption status, host firewall state, screen lock timeout, and active EDR daemon status);
- Corporate identity correlation claims (work email or immutable SCIM subject identifier) required to complete SAML 2.0 / OIDC sign-in handshakes.
As detailed in our Employee Privacy Charter, the agent cannot read personal files, browsing history, emails, clipboard data, keystrokes, or GPS coordinates.
4. Data Retention and Deletion
Active posture records follow the retention window configured by the Customer Administrator (30 days by default on Core plans; configurable up to 365 days on Enterprise plans). Upon contract termination or written controller instruction, all tenant cryptographic keys and database partitions are cryptographically purged within 30 calendar days.
5. International Transfers & Contact
Cross-border transfers from the European Economic Area, United Kingdom, and Switzerland are safeguarded under the EU Standard Contractual Clauses (Module Two: Controller-to-Processor) and UK International Data Transfer Addendum. Inquiries for our Data Protection Officer may be directed to privacy@devicetrustportal.com.