Privacy Policy
Last Updated: October 14, 2026
1. Overview
RoninArmor ("we", "us", or "our") provides server security software, including our server agent, web application firewall (WAF), malware scanner, and management dashboard.
This Privacy Policy explains clearly what information we collect from you, why we collect it, how we keep it safe, and what rights you have over your personal data.
2. Who Controls Your Data
Under data protection laws (such as the EU GDPR and Indonesian PDP Law), we process information in two different roles:
1. We are the Data Controller for your account information:
This includes your name, company name, billing details, and login email. We decide how to handle this information to operate your account and bill you for our services.
2. We are the Data Processor for your servers:
When our agent runs on your server to scan files and block network attacks, you own and control that server data. We only process that data to keep your server protected based on your service agreement.
3. The Information We Collect
We only collect information that is strictly needed to provide, improve, and secure our services:
| Category | What Is Included | Why We Collect It |
|---|---|---|
| Account & Billing | Your name, email address, company name, billing address, and payment confirmation tokens. | To create your account, issue invoices, and manage your active licenses. |
| Server Information | Server IP address, operating system, hostname, agent version, and CPU/memory usage stats. | To confirm your license validity and ensure the security agent runs smoothly. |
| Attack Logs | The attacking IP address, targeted URL, timestamp, triggered firewall rule, and blocked payload. | To block attacks in real time and display security charts in your dashboard. |
| Suspicious Files | File names, file paths, SHA-256 hashes, and isolated code snippets from malicious files. | To test malware safely in our cloud lab and build new detection signatures. |
4. What We Do NOT Collect
We Never Access Your Databases
RoninArmor is an infrastructure defense tool. We do not read, view, download, or copy any data inside your application databases (such as MySQL, PostgreSQL, MariaDB, Redis, or MongoDB). We cannot see your private customer records, user account passwords, or financial transactions.
Our firewall also automatically masks sensitive fields (like credit card numbers, passwords, and cookies) before recording attack logs.
5. How We Use Your Data
We use your data only for practical business and technical purposes:
- To provide our service: Verifying server licenses, delivering firewall updates, and processing invoices.
- To protect your servers: Blocking malicious IP addresses, detecting viruses, and stopping DDoS attacks.
- To help you: Troubleshooting technical support tickets and fixing software bugs.
- To follow the law: Preserving mandatory tax receipts and financial audit records.
We do not sell, rent, or trade your personal data to anyone.
6. Malware Testing and Threat Defense
To protect all connected servers against new threats, we use collective threat defense:
- Malware Testing: When our scanner detects an unknown infected file, a copy is tested inside an isolated cloud sandbox. This testing environment has zero connection to your server or customer accounts.
- Global IP Blacklist: When an IP address attacks servers, we add that IP to our global defense list. We never share your company name, domain, or server IP when distributing these threat alerts.
7. Companies We Work With
We use trusted third-party service providers to help run our platform under strict data confidentiality agreements:
| Service Type | What They Do | Security Standards |
|---|---|---|
| Cloud Hosting | Hosts our customer portal, threat intelligence database, and update APIs. | SOC 2 / ISO 27001 certified data centers with encrypted storage. |
| Payment Processors | Handles credit card transactions and subscription renewals securely. | PCI-DSS Level 1 certified. We never store credit card numbers. |
| Transactional Email | Sends password resets, payment receipts, and critical server status notices. | TLS-encrypted email transmission. |
8. How Long We Keep Your Data
We only store data for as long as necessary, after which it is deleted or anonymized:
| Data Type | Retention Period | Disposal Method |
|---|---|---|
| Account & Invoices | Active account period + 7 years (for official tax requirements). | Removed from active systems; archived strictly for legal tax audits. |
| Firewall & Attack Logs | 30 to 90 days. | Automatically deleted on a rolling schedule. |
| Malware Samples | Up to 180 days. | Permanently deleted once detection signatures are created. |
9. How We Keep Your Data Safe
We apply strong technical measures to safeguard your information:
- Encryption Everywhere: All data transmitted between your server agent and our cloud is encrypted via TLS 1.3. Stored records are protected using AES-256 encryption.
- Strict Access Control: Only authorized engineering staff have access to production servers, protected by two-factor authentication (2FA).
- Digitally Signed Updates: Every software update and firewall rule sent to your server is cryptographically signed to prevent tampering.
10. Your Privacy Rights
You have clear rights regarding your personal information:
- Right to Access: You can request a copy of the personal information we hold about you.
- Right to Correct: You can update or fix inaccurate billing and account details in your dashboard.
- Right to Delete: You can request that we delete your personal data when you close your account.
To exercise any of these rights, open a ticket in your client dashboard or contact our privacy desk.
11. Cookies
We only use essential session cookies needed to keep you securely logged into your management console and protect against CSRF attacks. We do not use third-party advertising cookies or tracking pixels.
12. Legal and Government Requests
We will only provide customer account or log details if compelled by a valid, legally enforceable court order or subpoena. Unless legally prohibited, we will notify you beforehand so you have the opportunity to challenge the request.
13. Changes to This Policy
If we make significant changes to this Privacy Policy, we will provide at least 30 days advance notice through an email or a dashboard notification before the new terms take effect.
14. Contact Us
If you have any questions or data requests regarding this Privacy Policy, please contact our team:
RoninArmor Legal & Compliance Team
Email: [email protected]
Support Desk: Client Dashboard > Support Tickets > Legal & Privacy
