Privacy Policy

IronShield Technologies Inc. (“IronShield,” “we,” “us,” or “our”) provides a CMMC compliance management platform that helps defense industrial base contractors track cybersecurity posture, manage Plans of Action and Milestones (POA&Ms), calculate SPRS scores, and prepare for CMMC assessments. This Privacy Policy explains how we collect, use, disclose, and protect information when you use our platform, websites, and related services (collectively, the “Services”).

This Policy applies to all visitors, demo users, and paying customers. By accessing or using the Services, you agree to the practices described in this Policy.

Before describing our data practices, IronShield makes the following important disclosures:

4.1 Compliance Assessment Data

When you use the platform to manage your CMMC compliance program, we collect and store the compliance assessment data you input, including:

• SPRS scores and calculation inputs
• POA&M entries including weakness descriptions, remediation plans, responsible parties, milestones, and target dates
• NIST SP 800-171 control implementation statuses
• Evidence artifacts and documentation you upload
• Assessment notes and comments
• Audit trail logs tracking changes to compliance records

IronShield treats Compliance Assessment Data as sensitive business information. We process this data solely to provide the Services and do not use it for advertising, analytics, model training, or any purpose beyond service delivery.

4.2 Account Data

When you register for or use the Services, we collect:

• Organizational information including company legal name, CAGE code, UEI/DUNS number, address, and phone number
• User information including names, email addresses, job titles, and role assignments
• Authentication credentials (passwords are hashed and never stored in plaintext)
• Billing information including company payment details (payment card data is processed by our payment processor and not stored by IronShield)
• Onboarding responses including CMMC target level, assessment type, environment, and compliance deadline

4.3 Usage Data

We automatically collect certain technical information when you access the Services, including IP addresses and approximate geographic location, browser type and device identifiers, pages and features accessed, session duration and navigation patterns, error logs and performance data, and referring URLs.

4.4 Communications Data

We collect information you provide when contacting support, submitting feedback, responding to surveys, or communicating with us by any means.

4.5 Cookies and Similar Technologies

We use cookies and similar technologies to maintain session state, remember preferences, measure platform performance, and improve the Services. We do not use third-party advertising cookies. You may disable cookies in your browser settings, but doing so may affect platform functionality. We honor Global Privacy Control (GPC) signals for applicable opt-out rights.

5.1 To Provide and Operate the Services

• Deliver, maintain, and improve the compliance management platform
• Calculate SPRS scores and POA&M eligibility classifications
• Integrate with the Tolerance API for NIST SP 800-171 validation
• Store and retrieve compliance records, evidence, and audit trails
• Process onboarding responses to pre-populate your compliance profile
• Generate compliance reports and exports

5.2 Account and Relationship Management

• Manage user authentication and access controls
• Process billing and subscription management
• Send transactional communications including receipts, account notices, and security alerts
• Respond to support requests and inquiries
• Send product updates and compliance-relevant regulatory notices (you may opt out of non-transactional communications)

5.3 Security and Fraud Prevention

• Monitor for unauthorized access, security incidents, and platform abuse
• Investigate suspicious activity
• Enforce our Terms of Service and Acceptable Use Policy
• Maintain audit logs for security purposes

5.4 Platform Improvement

• Analyze aggregated, de-identified usage patterns to improve platform features
• Identify and fix bugs and performance issues
• Develop new features relevant to CMMC compliance workflows

IronShield does not use Compliance Assessment Data for platform improvement, analytics, or any purpose other than service delivery.

5.5 Legal and Compliance Obligations

• Comply with applicable law, regulation, and legal process
• Respond to lawful government requests
• Protect our legal rights and pursue available remedies

IronShield does not sell or rent your information to third parties. We share information only as described below.

6.1 Service Providers (Subprocessors)

We share information with vetted service providers who process data on our behalf to deliver the Services. All subprocessors are contractually bound to process data only as directed and to maintain appropriate security measures. Our current subprocessors are listed at tolerance.app/legal/subprocessors. We provide at least 30 days' advance notice before adding or replacing a subprocessor. All subprocessors used for storage or processing of Customer Data are US-based.

6.2 At Your Direction

We share information when you direct us to, such as when you export compliance reports for submission to a C3PAO assessor, a prime contractor, or the SPRS portal.

6.3 Legal Requirements

We may disclose information if required by applicable law, regulation, court order, or lawful government request. Where permitted, we will notify you before disclosing.

6.4 Business Transfers

In the event of a merger, acquisition, or sale of substantially all of our assets, Customer Data may be transferred to the acquiring entity subject to the same protections described in this Policy. We will provide notice before any such transfer.

6.5 With Your Consent

We may share information in other circumstances with your prior written consent.

IronShield implements technical, administrative, and physical security measures designed to protect your information. Our security practices include:

• Encryption of data at rest using AES-256 and in transit using TLS 1.2 or higher
• Role-based access controls (RBAC) with principle of least privilege
• Multi-factor authentication required for all platform access
• Comprehensive access logging and monitoring
• Regular third-party security assessments and penetration testing
• Logical data separation between customer tenants at the database level
• Background checks for all employees with access to production systems
• US-based data storage in US cloud regions

No security program is perfect. If you believe a security incident has occurred, contact us immediately at [email protected].

IronShield is working toward SOC 2 Type II certification. We will publish our certification status at tolerance.app/security.

We retain information for as long as necessary to provide the Services and fulfill the purposes described in this Policy, subject to legal obligations.

You may request deletion of your data at any time by contacting [email protected]. We will provide written confirmation of deletion upon request.

9.1 Access, Correction, and Deletion

You may access, correct, or request deletion of your Account Data at any time through your account settings or by contacting [email protected]. Compliance Assessment Data is owned and controlled by your organization — contact your account administrator to modify or delete compliance records.

9.2 Data Portability

You may export your Compliance Assessment Data in standard formats (JSON, CSV, PDF) at any time through the platform's export features.

9.3 Opt-Out of Non-Transactional Communications

You may opt out of marketing and non-essential communications at any time by clicking “unsubscribe” in any email or contacting [email protected]. You cannot opt out of transactional communications such as account security alerts, billing notices, and service updates.

9.4 California Residents (CCPA/CPRA)

California residents have additional rights under the CCPA as amended by the CPRA:

• Right to know: request disclosure of categories and specific pieces of personal information collected, used, or disclosed in the past 12 months
• Right to delete: request deletion of personal information, subject to certain exceptions
• Right to correct: request correction of inaccurate personal information
• Right to opt out: we do not sell or share personal information for cross-context behavioral advertising
• Right to non-discrimination: we will not discriminate against you for exercising these rights

To exercise California rights, submit a request to [email protected]. We will respond within 45 days. We may require identity verification before processing your request. California residents may designate an authorized agent by providing written authorization.

9.5 Delaware Residents

Delaware residents have rights under the Delaware Personal Data Privacy Act (DPDPA) including rights of access, correction, deletion, portability, and opt-out of targeted advertising and profiling. Submit requests to [email protected]. You may appeal a denied request by emailing [email protected] with the subject line “Privacy Request Appeal.”

If you access the Services through a demo, trial, or beta program:

• Your information receives the same security protections as paid customers
• We may collect additional usage and feedback data to improve the platform
• Compliance Assessment Data entered during a demo or beta period will be retained for 90 days following the end of the program, after which it will be permanently deleted unless you convert to a paid subscription
• Beta features may not have all production security controls in place; we will disclose material differences
• We may use aggregated, de-identified data from beta users to improve the platform

The Services are intended for use by business entities and their employees. We do not knowingly collect personal information from individuals under the age of 18. If you believe a minor has submitted information to our platform, contact [email protected] and we will promptly delete it.

We may update this Policy from time to time. For material changes, we will provide at least 14 days' advance notice via email to account administrators and/or in-platform notification before changes take effect. Non-material changes (such as clarifications or contact information updates) will be effective upon posting. The updated Policy will always be available at tolerance.app/legal/privacy. Continued use of the Services after the effective date constitutes acceptance of the updated Policy.

This Policy is designed to meet the requirements of applicable US state privacy laws. To the extent any state law provides rights not addressed above, those rights are hereby incorporated by reference. For state-specific questions or requests, contact [email protected] and identify your state of residence.

For privacy questions, requests, or concerns: