NISTForge Privacy Notice

Version 1.0, dated 2026-07-03

Provider: MALTO Cyber, Toronto, Ontario, Canada

This Privacy Notice explains how MALTO Cyber handles personal information in connection with the NISTForge product. It is written for the organizations that subscribe to and run NISTForge, and it is incorporated into the NISTForge Master Subscription Agreement.

This notice covers the product. It is separate from the privacy policy for our website at maltocyber.com, which covers visitors who browse the site or join a waitlist.

The short version

NISTForge runs on your own infrastructure. The data you assess with it stays there. We do not collect, access, or store your source documents, scan inputs, assessment content, findings, scores, or reports. The only information we receive is what we need to sell you a subscription, deliver the software to you, and keep your license valid. We designed it this way on purpose, because the data a vendor never holds is data that vendor can never lose, leak, or be compelled to hand over.

What stays on your infrastructure

Everything you actually work with in NISTForge stays inside your environment and never reaches us:

• the documents and evidence you upload or point the tool at,
• the scan inputs and configuration you provide,
• the assessment content, questionnaire responses, and control mappings,
• the findings, gap analyses, scores, and reports the tool generates, and
• any information about your systems, your staff, or your end users contained in the above.

We are not a processor of this data, because it does not come to us. It remains under your control on your infrastructure.

What we receive

The limited information we do receive relates to your account, your billing, and your license. We act as an independent controller of this information.

Account and billing information. When you subscribe, we collect your name, work email address, organization name, and the plan you choose. Payment is handled by our payment processor; we receive billing metadata such as your subscription status, plan, and the identifiers our processor returns to us. We do not receive or store full payment card numbers.

License and download telemetry. When you download the software, our download endpoint records your license identifier, your IP address, and your browser's user agent, and uses your IP address on a short-lived basis to rate-limit requests and prevent license sharing and automated probing. When the software checks for updates or validates its license, it may send its license identifier and version information so we can confirm the license is valid and tell you whether a newer version is available. These checks do not carry your Customer Data.

Support communications. If you contact us for support, we receive whatever you choose to include in your message. Please do not include sensitive assessment content in a support message; if something confidential is needed to resolve an issue, ask us for a secure channel first.

What we do not collect

We do not collect your Customer Data, as described above. We do not use advertising cookies, third-party analytics, or tracking pixels in the product, and we do not sell or rent personal information to anyone.

How we use what we receive

We use the account, billing, and license information to:

• provide and administer your subscription and issue and validate your License Key,
• deliver the software and updates to you and enforce reasonable usage limits,
• communicate with you about your subscription, security, and product updates,
• provide support, and
• meet our legal, tax, and record-keeping obligations.

Where the law requires a legal basis, we rely on the performance of our contract with you for account, billing, and license processing, on our legitimate interest in securing the software and preventing abuse, and on your consent for any optional marketing, which you can withdraw at any time.

Who we share it with

We share the limited information we hold only with the service providers that help us run the product, and only so they can perform that service:

• Our payment processor handles subscriptions and billing.
• Our cloud file provider stores and delivers the software releases you download.
• Our email provider delivers account and product email.
• Our portal infrastructure provider hosts the billing and licensing service.
• Our rate-limiting provider supports the short-lived limits on the download endpoint.

None of these providers receives your Customer Data, because we do not have it to share. We may also disclose information where we are legally required to, or to protect our rights, our users, or the security of our systems. If our business is sold or reorganized, information may transfer to the new owner, who would remain bound by a notice at least as protective as this one.

Where your data is processed

Your Customer Data is processed only on Your Infrastructure, wherever that is located, and never leaves it through us. The billing and license information we hold is processed on our infrastructure and by the providers above. Our billing and licensing service is hosted in Canada. Some providers are based in the United States and may process the limited information we hold there. Canadian privacy law lets us use foreign providers but does not let us hand off our accountability, so we remain responsible for that information wherever it is processed and choose providers that offer comparable protection.

How long we keep it

We keep account and billing information for as long as you have a subscription and afterward for as long as we need it to meet tax and record-keeping obligations, then we delete or anonymize it. License and download logs are kept for a short period for security and troubleshooting and then age out. Support messages are kept for as long as we need them to handle your request and keep reasonable business records.

Your rights

Depending on where your organization and its people are established, you or your personnel may have rights over personal information, including to access it, correct it, ask us to delete it, withdraw consent, and opt out of marketing. For marketing email the fastest route is the unsubscribe link in any message. For anything else, contact our Privacy Officer below and we will respond within the time the law allows.

• Canada (PIPEDA): access and correction rights.
• Quebec (Law 25): additional rights, including data portability, and access to our Privacy Officer.
• EU and UK (GDPR): rights of access, rectification, erasure, restriction, portability, and objection, and the right to complain to a supervisory authority.
• California (CCPA/CPRA): access and deletion rights. We do not sell or share personal information as those terms are defined under California law.

Because your Customer Data stays on Your Infrastructure, requests from your own personnel or end users about data held inside NISTForge are yours to fulfill, since we do not hold that data. We will help where we reasonably can.

Security

We take reasonable technical and organizational measures to protect the limited information we hold, and we keep what we collect small on purpose. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we experience a breach affecting personal information we hold, we will notify you and the relevant regulators as required by law.

Data processing addendum

Because we are not a processor of your Customer Data, a full data processing addendum is usually unnecessary. If you require a data processing addendum covering the limited billing and license information we do hold as a controller, contact us and we will provide one.

Contact and Privacy Officer

To exercise a right or ask a question about this notice, contact our Privacy Officer:

• Email: privacy@maltocyber.com
• MALTO Cyber, Toronto, Ontario, Canada

Changes to this notice

We may update this notice as the product or the law changes. When we do, we will revise the version date above and, for significant changes, give clearer notice through the product or by email.