Privacy Policy

01 Introduction & Scope

GSC Identity is an identity operations platform used by organizations to manage the lifecycle, authentication, authorization, and governance of people, machine identities, and autonomous agents across their systems. Our role under data-protection law depends on context:

• GSC as controller. For personal data about website visitors, prospects, account administrators, and billing contacts, GSC determines the purposes and means of processing and acts as a data controller.
• GSC as processor. For personal data within a customer's tenant processed by the platform on the customer's behalf, the customer is the controller and GSC acts as a processor, governed by the agreement between GSC and the customer, including any Data Processing Addendum (DPA).

Where GSC processes personal data on behalf of a customer, individuals should direct privacy requests to that customer (the controller). We assist our customers in responding as required by law and contract.

02 Personal Data We Collect

"Personal data" means information that identifies, relates to, or could reasonably be linked with an individual. We collect the categories below.

From the website

• Information you submit through forms, such as name, business email, company, role, and your demo request or message.
• Technical data generated automatically, such as IP address, device and browser type, referring pages, pages viewed, and timestamps.
• Cookie and similar-technology identifiers, as described in our Cookie Policy.

From account creation & subscription activation

• Administrator and user account details: name, business email, username, organization, job role, and authentication identifiers.
• Subscription and provisioning data: plan, entitlements, tenant identifiers, and activation status. Where you purchase through the Microsoft commercial marketplace, we receive the transaction and subscription information Microsoft provides to complete fulfillment.
• Billing contact details. Payment card processing is handled by Microsoft or a PCI-DSS-compliant processor; GSC does not store full payment card numbers.

From the platform & identity workflows

• Identity records processed on behalf of customers, which may include names, usernames, work email addresses, employee or user identifiers, group and role memberships, entitlements, and access requests.
• Identity lifecycle events — joiner-mover-leaver actions, approvals, certifications, and policy decisions — with the actor and timestamp for each.

From agents, connectors & integrations

• Configuration and credential material (API keys, tokens, secrets) used to connect to systems you authorize, stored encrypted.
• Metadata exchanged with connected systems and identity providers (for example, Okta, Microsoft Entra, SailPoint, and messaging or verification services) per your configuration, and governance metadata for autonomous agents.

From analytics, logs & telemetry

• Product usage and feature-interaction events, performance and diagnostic telemetry, and error reports.
• Security and audit logs, including authentication events and administrative actions.

From marketplace fulfillment

• When you acquire GSC Identity through the Microsoft commercial marketplace, Microsoft provides the information needed to fulfill and manage your subscription, which may include tenant and subscription identifiers, the purchasing identity, plan, and billing status.

03 How We Use Personal Data

• Operating the Services — provision, deliver, maintain, and support the website and platform.
• Identity lifecycle processing — perform the identity management, provisioning, and governance functions customers configure.
• Authentication & authorization — verify users, enforce access policies, and apply multi-factor authentication.
• Customer support — respond to requests, diagnose issues, and communicate about the Services.
• Compliance & auditing — maintain audit trails, meet legal obligations, and support customers' compliance programs.
• Security & abuse prevention — detect, investigate, and prevent fraud, abuse, and security incidents.
• Service improvement — analyze usage, improve performance and reliability, and develop features.
• Marketplace fulfillment — activate, bill, and manage subscriptions acquired through the Microsoft commercial marketplace.
• Communications — send service and transactional messages and, where permitted, limited marketing you can opt out of at any time.

Where required by law (for example, the GDPR), we rely on an appropriate legal basis for each purpose: performance of a contract, our legitimate interests in operating and securing the Services, compliance with a legal obligation, or your consent.

04 How We Share Personal Data

• Service providers & sub-processors — vendors processing data on our behalf under written agreements limiting their use, including analytics, communications, support, and infrastructure providers.
• Cloud hosting providers — the Services are hosted on Microsoft Azure, which processes data on our behalf to run the platform.
• Microsoft commercial marketplace fulfillment — we exchange the information necessary with Microsoft to complete and manage fulfillment and billing.
• Security & compliance partners — auditors, security-monitoring providers, and advisors under confidentiality obligations.
• Connected systems you authorize — at your direction, the platform exchanges data with the identity providers, connectors, and integrations you configure.
• Legal & safety — where required by law, legal process, or government request, or to protect the rights, safety, and security of GSC, our customers, or others.
• Business transfers — in a merger, acquisition, financing, or sale of assets, personal data may be transferred subject to this Policy.

We do not sell personal data, and we do not share personal data for cross-context behavioral advertising.

05 Cookies & Tracking

We use strictly necessary, preference, and analytics cookies. We do not use advertising cookies. You can manage non-essential cookies through our consent banner and your browser, and we honor recognized opt-out signals such as Global Privacy Control (GPC) where applicable. For full detail, see our Cookie Policy.

06 Security Protections

• Encryption — data encrypted in transit with TLS 1.3 and at rest.
• Access controls — role-based access, least privilege, and MFA for administrative access; connector secrets stored encrypted.
• Monitoring — continuous logging, security monitoring, and vulnerability management.
• Zero Trust — access verified on every request rather than assumed from network location.
• Breach procedures — an incident-response program, with notification to affected customers and individuals without undue delay and as required by law and contract.

Our program is aligned with NIST 800-53, ISO/IEC 27001, SOC 2, and HIPAA safeguards. See our Security & Trust Center for more.

07 Data Retention

• Account & subscription data — retained for the duration of the relationship and a limited period afterward for legal, tax, and audit obligations.
• Customer platform data — retained per the customer's configuration and agreement, and deleted or returned on termination as set out in the DPA.
• Logs and telemetry — retained on rolling schedules appropriate to their security and operational purpose.

08 International Data Transfers

GSC is based in the United States, and personal data may be processed in the United States and other countries where we or our service providers operate. Where we transfer personal data across borders, we use appropriate safeguards required by law, such as the European Commission's Standard Contractual Clauses.

09 Your Privacy Rights

Depending on where you live, you may have the right to access, correct, delete, or port your personal data; to restrict or object to certain processing; and to opt out of marketing or withdraw consent. Because we do not sell personal data or use it for cross-context behavioral advertising, there is no such activity to opt out of. We will not discriminate against you for exercising your rights.

To exercise a right, contact us using the details in Section 12. We verify requests and respond within the timeframe required by law. If your data is processed on behalf of a customer, we will refer your request to that customer or assist them in responding. You may also lodge a complaint with your local data-protection authority.

10 Children's Privacy

The Services are intended for businesses and are not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will take appropriate steps to delete it.

11 Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will revise the "Last Updated" date and, where appropriate, provide additional notice. Continued use of the Services after an update means you acknowledge the revised Policy.

12 Contact Information