Privacy Policy

Effective date: October 14, 2026

Last updated: October 14, 2026

SecuritySage may update this Privacy Policy from time to time. The version posted on this page, with the “Last updated” date shown above, is the version that applies.

1. Who we are

SecuritySage (“SecuritySage,” “we,” “us” or “our”) is a cybersecurity consultancy based in Lakewood, Ohio 44107, USA. We provide simplified, practical cybersecurity services for startups and small businesses, including security audits and assessments, security awareness training, security policy development, cloud and infrastructure security consulting, phishing simulation and virtual CISO (vCISO) advisory. We also sell self-paced digital training programs through our website at https://www.securitysage.org (the “Site”).

For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, SecuritySage is the “controller” of the personal data described in this Privacy Policy, meaning we decide why and how that data is processed. Under US state privacy laws, we act as the “business” or “controller” for that information.

You can contact us about anything in this Privacy Policy at:

• Email: [email protected]
• Postal location: SecuritySage, Lakewood, Ohio 44107, USA
• Website: Contact us page

2. Scope of this policy

This Privacy Policy explains how we collect, use, share and protect personal information when you:

• visit or browse the Site, including our blog, glossary and resource pages;
• use our free interactive security self-assessment;
• contact us or request a consultation through our contact or get started forms;
• sign up for our newsletter;
• create a customer account, buy or access one of our self-paced programs;
• leave a comment on a blog post, where comments are enabled; or
• otherwise communicate with us by email or phone.

This policy does not cover data we process on behalf of our clients during consulting or security engagements (for example, systems, logs, user accounts or files we review during an audit). That information is handled under the separate engagement agreement and, where applicable, a data processing agreement with the client. See Client data processed during security engagements below.

This policy also does not apply to third-party websites, services or applications that we link to. Those services have their own privacy policies, and we encourage you to read them.

How we use cookies and similar technologies is explained in more detail in our Cookie Policy, which forms part of this Privacy Policy.

3. Information we collect

We aim to collect only what we need. The information we collect falls into four groups.

3.1 Information you provide to us

• Contact and get-started forms: first name, last name, email address, company name, phone number, job title, the service you are interested in, and the content of your message. Anything you choose to include in the message (for example, a description of your IT environment or a security concern) is also collected. Please do not include passwords, credentials or highly sensitive information in form messages.
• Newsletter signup: your email address and a record of when and how you subscribed.
• Customer accounts and orders (WooCommerce): name, email address, username, password (stored in hashed form), billing address, company name, phone number, order history, programs purchased, program access and progress information, and any notes you add to an order.
• Payment information: when you buy a program, payment card or account details are entered directly with our third-party payment processor (such as Stripe or PayPal). We receive limited information back from the processor, such as the payment status, the last four digits and type of card, the billing name and address, and a transaction identifier. We do not receive or store full card numbers or security codes.
• Blog comments: if comments are enabled, your name, email address, optional website, the comment text and the time it was posted. Your name, website and comment are displayed publicly. Your email address is not published.
• Correspondence: the content of emails, calls or messages you exchange with us, including scheduling details and feedback.
• Self-assessment answers you choose to send: if you decide to submit your self-assessment results through the contact form, we receive those results together with your form details.

3.2 Information collected automatically

When you visit the Site, our servers and security tools automatically receive certain technical information, including:

• IP address and approximate location derived from it (country or region level);
• browser type and version, operating system and device type;
• the pages you request, the referring page, and the date and time of each request;
• server and security logs, including failed login attempts, blocked requests and other events that may indicate an attack; and
• if you have given consent to analytics, information about how you interact with the Site, such as pages viewed, time on page and general navigation paths.

About the self-assessment quiz: our security self-assessment runs entirely in your web browser. Your answers and score are calculated on your device and are not transmitted to or stored on our servers unless you choose to submit the contact form. Some interactive features (such as saving checklist progress in blog articles) use your browser’s local storage, which stays on your device; see our Cookie Policy.

3.3 Cookies and similar technologies

We use cookies and similar technologies (such as browser local storage) to keep the Site working, remember your preferences, keep your account and cart secure, protect the Site from attacks, record your cookie choices, and, only with your consent, measure how the Site is used. Strictly necessary cookies are set without consent because the Site cannot function properly without them. All other categories are optional and are set only if you accept them through our cookie consent banner (powered by CookieYes). Full details, including a list of typical cookies and their durations, are in our Cookie Policy.

3.4 Information from third parties

• Payment processors: confirmation of payment, transaction identifiers, and fraud-screening results.
• Security services: threat intelligence, such as lists of IP addresses known to be associated with malicious activity, used by our security plugins to block attacks.
• Analytics providers (only with consent): aggregated statistics about Site usage.
• Business contacts and referrals: if someone refers you to us, or if we meet you at an event, we may receive your name, business contact details and the context of the referral.
• Publicly available sources: professional information you have made public (for example, on a company website), used only to prepare for a business conversation you have requested.

3.5 Sensitive information

We do not intentionally collect sensitive personal information (such as health information, government ID numbers, precise geolocation, racial or ethnic origin, religious beliefs or biometric data) through the Site. Account passwords are the only “sensitive personal information” as defined by California law that we process through the Site, and we use them only to let you log in securely. We do not use or disclose sensitive personal information to infer characteristics about you. Please do not send us sensitive information through our forms.

4. How we use your information

We use personal information for the following purposes:

• To respond to inquiries: to reply to your messages, schedule consultations, prepare proposals and discuss the services you asked about.
• To provide programs: to process orders, create and manage your account, deliver access to purchased programs, send order confirmations and receipts, and provide customer support.
• To provide consulting services: to set up and manage client relationships, send invoices, and communicate about engagements.
• To send our newsletter: to send security tips, articles and updates you have subscribed to.
• To operate and secure the Site: to host the Site, prevent spam, detect and block attacks, investigate security incidents, enforce our Terms & Conditions, and maintain backups.
• To improve the Site (with consent): to understand which content is useful and how visitors navigate the Site, using analytics only where you have consented.
• To manage blog comments: to display, moderate and filter comments for spam.
• To meet legal obligations: to keep tax and accounting records, respond to lawful requests, and handle privacy rights requests.
• To protect rights and safety: to establish, exercise or defend legal claims and to protect the rights, property or safety of SecuritySage, our clients, users or others.

We do not use your personal information for automated decision-making that produces legal or similarly significant effects on you, and we do not create advertising profiles about you.

5. Legal bases for processing (EEA and UK visitors)

If you are in the European Economic Area (EEA), the United Kingdom or Switzerland, we rely on the following legal bases under Article 6 of the GDPR and UK GDPR (see the text of Article 6 GDPR):

Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms, and you have the right to object (see Your rights under GDPR and UK GDPR).

6. How we share information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share personal information only as described below.

6.1 Service providers (processors)

We use carefully selected service providers who process personal information on our behalf and under our instructions. They are contractually required to protect the information and may not use it for their own purposes. Categories include:

• Website hosting and infrastructure: our hosting provider stores the Site, its database, server logs and backups.
• Email services: providers that deliver our business email, transactional emails (such as order confirmations and password resets) and newsletters.
• Payment processors: third-party payment processors integrated through WooCommerce, such as Stripe or PayPal, which process payments and may perform fraud screening. Payment processors may act as independent controllers for some of the data they process; their own privacy notices apply to that processing.
• Security plugins and services: we use security tools such as Wordfence (a web application firewall and malware scanner) and WP Hide & Security Enhancer to protect the Site. These tools may process IP addresses, user agents, request details and login activity to detect and block malicious traffic. Wordfence may send limited data, such as IP addresses involved in suspicious activity, to its service to check against threat intelligence and to protect the Site.
• Cookie consent management: CookieYes records and stores your cookie consent choices so that we can respect them and demonstrate compliance.
• Form handling and spam protection: the contact form system (Contact Form 7) and related anti-spam tools that process form submissions.
• SEO tooling: Yoast SEO helps us manage page titles, metadata and sitemaps. It does not, in our configuration, collect personal information about visitors.
• Analytics (only with consent): analytics providers that help us understand Site usage in aggregate.
• Professional advisers: accountants, lawyers and insurers, under confidentiality obligations, where needed to run our business.

6.2 Other disclosures

• Legal requirements: if we believe in good faith that disclosure is required by law, subpoena, court order or other legal process, or to respond to lawful requests from public authorities.
• Protection: to investigate or prevent fraud, security incidents or illegal activity, or to protect the rights, property and safety of SecuritySage, our users or others.
• Business transfers: if SecuritySage is involved in a merger, acquisition, financing, reorganization or sale of assets, personal information may be transferred as part of that transaction, subject to this Privacy Policy or a policy that is at least as protective.
• With your direction or consent: for example, if you ask us to introduce you to a partner or to send information to your IT provider.
• Public comments: information you post in blog comments is visible to anyone who visits the page.

7. International data transfers

SecuritySage is based in the United States, and our Site and service providers are primarily located in the United States. If you access the Site from outside the US, your personal information will be transferred to, stored and processed in the US and possibly in other countries where our service providers operate. Data protection laws in these countries may differ from those in your country.

Where we transfer personal data from the EEA, UK or Switzerland to a country that has not been found to provide an adequate level of protection, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum where relevant), or on a service provider’s certification under the EU-US Data Privacy Framework and its UK and Swiss extensions where applicable. You can contact us to request more information about the safeguards we use.

8. How long we keep information

We keep personal information only for as long as we need it for the purposes described in this policy, unless a longer period is required or permitted by law. Typical retention periods are shown below. When information is no longer needed, we delete or anonymize it, or, if that is not possible (for example, because it is in backups), we securely store it and isolate it from further use until deletion is possible.

9. How we protect information

Security is our business, and we apply the same practical approach to our own systems that we recommend to clients. Measures we use include:

• encryption in transit using HTTPS (TLS) across the entire Site;
• a web application firewall, malware scanning and login protection (Wordfence), along with hardening measures that reduce the Site’s exposure to automated attacks (WP Hide & Security Enhancer);
• multi-factor authentication and strong, unique passwords for administrative accounts;
• least-privilege access, so only people who need personal information to do their job can see it;
• hashed storage of account passwords;
• keeping WordPress, themes and plugins updated and removing software we no longer use;
• regular, tested backups; and
• payment card data handled by PCI DSS-compliant payment processors rather than on our servers.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident that affects your personal information, we will notify you and any relevant authorities as required by applicable law. If you believe you have found a security vulnerability on the Site, please report it to [email protected]. Please do not test the Site without our written authorization (see our Terms & Conditions).

10. Your rights under GDPR and UK GDPR

If you are in the EEA, UK or Switzerland, you have the following rights, subject to certain conditions and exceptions:

• Access: to obtain confirmation of whether we process your personal data and a copy of it.
• Rectification: to have inaccurate data corrected and incomplete data completed.
• Erasure: to have your data deleted in certain circumstances (sometimes called the “right to be forgotten”).
• Restriction: to ask us to limit how we use your data in certain circumstances.
• Data portability: to receive data you provided to us in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.
• Objection: to object to processing based on our legitimate interests, and to object at any time to direct marketing.
• Withdraw consent: where processing is based on consent, to withdraw it at any time.
• Complaint: to lodge a complaint with your local data protection supervisory authority. In the UK, this is the Information Commissioner’s Office (ICO). We would appreciate the chance to address your concerns first, so please contact us.

We will respond to requests within one month, which may be extended by up to two further months for complex or numerous requests, in which case we will tell you why.

11. Your rights under California law (CCPA/CPRA)

This section applies to California residents and supplements the rest of this Privacy Policy. It describes our practices under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”). To the extent the CCPA applies to SecuritySage, California residents have the rights described below.

11.1 Notice at collection: categories of personal information

In the preceding 12 months, we have collected the following categories of personal information. For each category, the table shows where it comes from, why we use it and to whom we disclose it for a business purpose.

We do not collect characteristics of protected classifications, biometric information or inferences to create profiles about you. Retention periods for each category are described in How long we keep information.

11.2 Your California rights

• Right to know: to request the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purposes, and the categories of third parties to whom we disclosed it.
• Right to delete: to request deletion of personal information we collected from you, subject to legal exceptions (for example, records we must keep for tax purposes).
• Right to correct: to request correction of inaccurate personal information.
• Right to opt out of sale or sharing: to opt out of the “sale” of personal information or its “sharing” for cross-context behavioral advertising.
• Right to limit use of sensitive personal information: to limit our use of sensitive personal information to purposes permitted by the CCPA.
• Right to non-discrimination: we will not deny you goods or services, charge you different prices, or provide a different level of quality because you exercised your rights.

11.3 Do Not Sell or Share My Personal Information

SecuritySage does not sell personal information and does not share personal information for cross-context behavioral advertising, as those terms are defined under the CCPA. We have not done so in the preceding 12 months. We have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age. If we ever change this practice, we will update this policy and provide a “Do Not Sell or Share My Personal Information” mechanism before doing so. You can also signal your opt-out preference at any time using Global Privacy Control (see Global Privacy Control), and we will honor it.

11.4 Sensitive personal information

We use sensitive personal information (your account password) only for purposes permitted under the CCPA regulations, namely to provide the account you requested and to keep it secure. We do not use or disclose it to infer characteristics about you. Because of this, a separate “Limit the Use of My Sensitive Personal Information” link is not required, but you may still contact us with any questions.

11.5 Authorized agents and other California notices

You may use an authorized agent to submit a request on your behalf. We may require the agent to provide signed written permission from you and may ask you to verify your identity directly with us. Under California’s “Shine the Light” law (Cal. Civ. Code §1798.83), California residents may request information about disclosures of personal information to third parties for their own direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.

12. Rights under other US state privacy laws

A growing number of US states have comprehensive consumer privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island, among others. Depending on where you live and whether the law applies to SecuritySage, you may have some or all of the following rights:

• to confirm whether we process your personal data and to access it;
• to correct inaccuracies in your personal data;
• to delete personal data provided by or obtained about you;
• to obtain a copy of your personal data in a portable and, where technically feasible, readily usable format;
• to opt out of the processing of your personal data for targeted advertising, sale, or profiling in furtherance of decisions that produce legal or similarly significant effects (we do not engage in these activities); and
• to appeal our decision on your request.

Appeals: if we decline to take action on your request, you may appeal by emailing [email protected] with the subject line “Privacy Request Appeal” within a reasonable time after receiving our decision. We will respond in writing within the period required by your state’s law (generally 45 or 60 days) and explain the reasons for our decision. If your appeal is denied, you may contact your state Attorney General.

Even where a state law does not technically apply to us, we aim to honor reasonable requests to access, correct or delete personal information from any user.

13. How to exercise your rights and how we verify requests

To make a privacy request, email [email protected] with the subject line “Privacy Request.” Please tell us:

• your name and the email address you used with us;
• which right you want to exercise (for example, access, deletion or correction);
• the state or country where you live; and
• enough detail for us to understand and respond to your request.

If you have a customer account, you can also view and update much of your account information directly by logging in.

Verification: to protect your information, we must verify your identity before fulfilling access, deletion or correction requests. We will usually do this by matching information you provide with information we already hold, such as asking you to confirm the request from the email address associated with your account or order, or asking for details of a recent order. For requests for specific pieces of information, we may ask for additional verification. We will only use the information you provide for verification to verify your identity and respond to your request. If we cannot verify your identity, we will explain why and may deny the request.

Timing: we will acknowledge requests promptly and respond within the time required by applicable law, generally within 45 days for US state law requests (extendable by a further 45 days where reasonably necessary, with notice to you) and within one month for GDPR and UK GDPR requests.

Fees: we do not charge a fee to process requests unless they are manifestly unfounded, excessive or repetitive, in which case we may charge a reasonable fee or decline the request and explain why.

14. Global Privacy Control

Global Privacy Control (GPC) is a browser setting or extension that tells websites you do not want your personal information sold or shared. When we detect a GPC signal from your browser, we treat it as a valid request to opt out of the sale or sharing of your personal information and of targeted advertising for that browser, and our cookie consent tool will not load optional analytics or marketing cookies unless you separately and expressly choose to enable them. Because we do not sell or share personal information, GPC mainly serves as an additional assurance. If you are logged in to an account, we will also apply the opt-out to that account where we can.

The Site does not currently respond to “Do Not Track” browser signals, because there is no common industry standard for them. We do honor GPC as described above.

15. Children’s privacy

The Site and our programs are intended for businesses and adults. They are not directed to children, and we do not knowingly collect personal information from children under 13, in line with the US Children’s Online Privacy Protection Act (COPPA). We also do not knowingly collect personal information from anyone under 16, and you must be at least 18 (or the age of majority where you live) to buy a program or engage our services. If you believe a child has provided us with personal information, please contact us at [email protected] and we will delete it promptly.

16. Marketing communications and CAN-SPAM

We send our newsletter only to people who have signed up for it. We may also send occasional business emails to existing clients and customers about services or programs related to those they have used, where permitted by law.

In line with the US CAN-SPAM Act and similar laws, our marketing emails:

• identify SecuritySage as the sender and use accurate subject lines;
• include our location (Lakewood, Ohio 44107, USA); and
• include a clear unsubscribe link.

You can unsubscribe at any time by clicking the link in any marketing email or by emailing [email protected]. We will process unsubscribe requests promptly and in any case within 10 business days. Even if you unsubscribe from marketing, we may still send you transactional or relationship messages, such as order confirmations, password resets, program access information or responses to your inquiries. For more on the CAN-SPAM Act, see the FTC’s CAN-SPAM compliance guide.

We do not send marketing text messages. If you provide a phone number, we will use it only to contact you about your inquiry or engagement.

17. Client data processed during security engagements

When we provide consulting services, such as security audits, risk assessments, phishing simulations, cloud security reviews or vCISO advisory, we may access or process information belonging to our clients and their employees, customers or users. This can include system configurations, user account lists, email addresses for phishing simulations, logs, vulnerability findings and other confidential material.

That information is not governed by this Privacy Policy. Instead:

• it is processed only under a written engagement agreement or statement of work with the client and, where personal data is involved, a data processing agreement (DPA) or business associate agreement (BAA) as appropriate;
• we act as a service provider or processor, using the data only to perform the agreed services and following the client’s instructions;
• it is treated as strictly confidential and protected with access controls, encryption and secure transfer methods agreed with the client;
• we collect only what is needed for the engagement and avoid copying sensitive data where a review can be done in place; and
• it is returned or securely deleted at the end of the engagement, as set out in the agreement.

If you are an employee or customer of one of our clients and have a question about how your data was handled during an engagement, please contact that organization first, as it controls the data. We will assist our clients in responding to such requests.

18. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, technology, legal requirements or the services we offer. When we make changes, we will update the “Last updated” date at the top of this page. If the changes are material, we will provide more prominent notice, such as a notice on the Site or an email to account holders and subscribers, before the changes take effect where required by law. We encourage you to review this policy periodically.

19. Contact us

If you have questions, concerns or requests about this Privacy Policy or our handling of personal information, please contact us:

• Email: [email protected] (subject line “Privacy”)
• Location: SecuritySage, Lakewood, Ohio 44107, USA
• Online: Contact us

We will do our best to respond to your inquiry promptly and to resolve any concern you raise.