What follows covers you as a customer of this storefront. Health information belonging to your patients answers to a separate agreement, and folio 05 sets out why it sits outside this record.
This covers what Fortify 24x7 keeps about you as a customer of the MediTrust Cyber storefront: who you are, what got bought, how it was paid for, and what you have written to the desk.
Health information your organization keeps about its patients is a wholly separate matter. Folio 05 picks that up, and it answers to the business associate agreement we both put a signature on.
Buying leaves us a name, a working email address, a company name and a billing address. The card itself goes to Stripe and never arrives here. Back to us come four digits, a card brand, and whether the charge succeeded.
Signing into the portal leaves the address used and the session token minted for it. Filing a note leaves whatever was written, alongside everything written back to you.
Running your lines produces operational material over your estate: machine names, agent health, detections, patch state, sweep findings, capture results, drill completion. Holding it is how the service gets operated and how evidence reaches you.
The website keeps a short server log of requests. That exists to hold the site upright and to notice an attack against it.
To run what you bought. To charge correctly for it. To answer you when you write. To meet what the law puts on us. And to keep our own systems intact. That is the complete list.
Nobody sells it. Nobody rents it. Not a line of it reaches anybody for advertising, and nothing handed to us goes into training a model.
Stripe takes payment and holds the card. Microsoft Azure hosts this site and the systems behind it. The security platforms named across this site process operational material, and only for the lines you actually bought.
Past that, disclosure happens where the law compels it, and we tell you whenever telling you is permitted. Nobody buying a list gets your details.
A number of lines place us alongside protected health information belonging to your patients. None of that belongs to us, it sits outside this record, and the agreement carrying both signatures before provisioning is what governs it.
Under that agreement it serves provision of the service and nothing else, it is safeguarded as the agreement demands, reported on where the agreement says so, and returned or destroyed when the arrangement closes. Your patients exercise their rights over it through you, which is where the law puts them.
Account and billing material stays while you remain a customer, then for a further seven years, because tax and accounting rules demand it.
Notes stay three years past closure, so a recurring problem keeps its own history fastened to it.
Operational material stays for the retention window recorded in your scope. Portal session tokens die within days. Server logs last ninety.
Encrypted while moving, encrypted while sitting still. Open only to engineers whose work genuinely requires it, behind multi factor authentication, and each access written down.
Our own estate runs on the lines we sell. That is not a marketing point. It is the floor anybody should expect from a company selling security work.
Ask for a copy of everything held about you. Ask that a wrong detail be corrected. Ask that whatever we have no obligation to retain be deleted. Ask for the lot in portable form, addressed elsewhere. The final folio carries the address, and a reply follows inside thirty days.
Where you live may hand you further rights. The same process applies to everybody rather than sorting requests by geography. Making one costs nothing and changes how you are treated not at all.
This storefront sells to organizations rather than to individuals, and nothing here is aimed at anybody under eighteen. Details are not knowingly collected from children. Write if you believe otherwise and they get removed.
Edits arrive as what we do changes. Whatever date sits at the top belongs to the version you have open. Anything material is written to whichever address the account carries, ahead of it taking hold.
Anything in this record goes to support@meditrustcyber.com. A note filed inside your portal reaches the same desk.