Privacy Policy

Effective Date: Mar. 1, 2026

NISTBox™ (“we,” “our,” or “us”) respects your privacy and is committed to protecting your information. This Privacy Policy explains how we collect, use, and safeguard data when you use our services.

1. Information Collection

We collect information you provide directly, including business name and contact information, domains, systems, and assets submitted for analysis, account registration details, and communications with NISTBox™. We also collect information automatically, such as IP address, device information, usage data (including pages visited and features used), and log files or interaction data.

As part of our core cybersecurity services, NISTBox™ may collect and process publicly available cybersecurity data, credential exposure indicators, breach and threat intelligence signals, and domain or infrastructure-related metadata. This data may be obtained from public sources, third-party providers, or automated analysis systems.

2. Use of Information

We use collected information to provide cyber risk analysis and monitoring services, generate reports such as the Cyber Risk Score™ and Trust Ledger™, detect exposures and potential threats, improve platform functionality and accuracy, and communicate with users regarding services.

3. User Responsibility

By using NISTBox™, you represent that you have the right and authorization to submit any domains, systems, or assets for analysis. NISTBox™ does not independently verify ownership and relies on your representations.

4. Data Sharing

We do not sell your data. We may share data with trusted service providers such as hosting, analytics, and security tools; with third-party data providers for enrichment and analysis; and with legal authorities when required by law.

5. Publicly Available Information & Trust Ledger™

Some outputs generated by NISTBox™ may be based on publicly available information, may be aggregated or anonymized, and may be used to improve our services. If you use Trust Ledger™, certain information may be made publicly accessible. You control what is submitted and published, and NISTBox™ may display verified or structured remediation summaries.

6. Data Retention & Safeguards

We retain data only as long as necessary to provide services, comply with legal obligations, and improve security and analytics. NISTBox™ implements reasonable safeguards to protect data, including encryption, access controls, and monitoring.

7. Contact Us

If you have any questions or suggestions about our Privacy Policy, do not hesitate to contact us.