Privacy Policy
Effective date: 15 October 2026 · SignalsGuard Ltd
1. Who we are
SignalsGuard Ltd ("we") is a signalling threat intelligence company and operates the platform at signalsguard.com. For our clients' signalling data we act as a processor on their instructions; for account, website and enquiry data we act as controller. Contact for data protection matters: admin@signalsguard.com.
2. What we process and why
| Category | Examples | Purpose | Retention |
|---|---|---|---|
| Account data | Name, work email, job title, organisation, role, login times | Providing and securing the service | Duration of the account + 90 days |
| Signalling event metadata (client data) | Time, protocol, operation, firewall action, sending network and country, the sending node's Global Title, Diameter Origin-Host/realm or IP address, campaign IDs, free-text event descriptions | Threat detection, scoring, reporting to the client; shared intelligence only where the client has opted in (section 4) | 24 months rolling, or earlier deletion on the client's instruction |
| Uploaded files (SFTP / portal) | Firewall or probe export files | Malware and format checks, then loading on approval | Deleted from staging once approved or rejected |
| Usage and security logs | IP address, request times, sign-in attempts, two-factor and password changes | Security, abuse prevention, troubleshooting | 12 months |
| Enquiries, support and access requests | Name, email, organisation, messages and attachments you send us, and our replies | Responding and provisioning access | Until resolved + 30 days, or for the account's life if one is created |
Network identifiers such as a Global Title or Diameter host identify network equipment of the sending operator, not a person.
3. What we do not hold
- Full IMSIs (reduced to MCC+MNC at ingestion) and full MSISDNs (replaced by a keyed hash)
- IMEIs, cell IDs or precise location coordinates
- Call or message content
Portal and SFTP uploads containing msisdn, imsi, imei or cell_id columns are rejected row by row; other ingestion routes reduce these values as described above before anything is stored.
4. Shared intelligence (opt-in)
Each client organisation's data is visible only to that organisation. If a client opts in to threat sharing, its events join the shared intelligence pool used to show other clients which sending networks and techniques are active. Shared views never identify which operator was targeted, and the setting can be switched off at any time. Our own sample dataset ("vendor feed") is also part of the pool and is labelled as such.
5. AI-generated explanations
Written threat briefs and anomaly explanations are produced by Anthropic's Claude API. What we send consists of event counts, categories, operations, sending-network names and countries, and short event descriptions for the selected scope — no subscriber identifiers and no account data. Anthropic processes this in the United States under its commercial terms, which do not permit training on API data. Clients can ask us to disable AI features for their organisation.
6. Malware checks
Files uploaded by SFTP are checked against VirusTotal (Google) by SHA-256 hash only. File contents are not sent to VirusTotal unless a client has agreed otherwise in writing.
7. Sub-processors and where data is processed
| Provider | Service | Data | Location |
|---|---|---|---|
| Neon | Database | All stored platform data | United Kingdom (London) |
| Railway | Application and SFTP servers | All data in transit through the API; staged upload files | European Union (Netherlands) |
| Vercel | Website hosting | Website requests (IP address, pages requested) | Global edge network |
| Cloudflare | DNS and email routing | Inbound email to signalsguard.com addresses, passed to our support inbox | Global edge network |
| Resend | Transactional email | Recipient email address and message content (welcome, password reset, notifications, replies to your enquiries) | United States |
| Anthropic | AI-written explanations | As described in section 5 | United States |
| VirusTotal (Google) | Malware reputation | SHA-256 hashes of uploaded files | United States / global |
Transfers outside the UK and EU rely on the providers' data processing terms with appropriate safeguards (such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum). We give clients notice before adding a sub-processor that handles their signalling data.
8. Lawful basis
- Contract: account data and client data processed to provide the service
- Legitimate interests: security logging, abuse prevention and responding to enquiries
- Consent: marketing emails (opt-in, withdrawable at any time)
9. Security
Access. Sign-in requires a password (stored as a bcrypt hash, 12-character complexity policy) and, for all SignalsGuard administrators and for any client organisation that switches it on, a time-based one-time code from an authenticator app (TOTP two-factor authentication, available to every user). Authenticator secrets are encrypted (AES-256-GCM) with a key held outside the database; one-time recovery codes are stored only as hashes. Sign-in, code entry and password resets are rate-limited, and repeated wrong codes temporarily lock two-factor sign-in for that account. Sessions expire after 8 hours, and changing or resetting a password signs out every other session. Password resets use single-use links that expire after one hour.
Data protection. Data is encrypted in transit (TLS) and at rest. Each client's data is logically isolated and access is checked on every request. API keys and reset tokens are stored only as hashes. SFTP uses per-provider credentials and is a write-only drop box.
Monitoring, backups and retention. Service health (including database connectivity) is monitored externally and failures alert us. Security-relevant events (sign-ins, failed attempts, two-factor and password changes) are logged and kept for 12 months. The database has continuous point-in-time recovery from our database provider, and we take a daily encrypted export kept for 14 days; restores are tested. The retention periods in section 2 are enforced by an automated daily deletion job; deleted data may persist in backups until they expire (at most 14 days).
10. Your rights
Under the UK GDPR and the Data Protection Act 2018 — and the EU GDPR where it applies to you — you can ask to access, correct, delete, restrict or port your personal data and object to processing. Email admin@signalsguard.com; we respond within one month. You may complain to the UK Information Commissioner’s Office (ICO) or your local data protection authority. Where we process data for a client, we will pass your request to that client.
11. Cookies and storage
The portal stores your sign-in token in the browser's session storage, which is cleared when the tab closes. We use no advertising, analytics or tracking cookies.
12. Changes
We notify active clients by email at least 14 days before material changes take effect.
Contact
Data protection: admin@signalsguard.com
SignalsGuard Ltd