GlacierPoint Scan Privacy Policy

Version 2026-10-23, effective 23 October 2026.

1. Who we are

GlacierPoint Scan is a security assessment service for organizations, provided by GlacierPoint Technologies LLC, 1043 S Roselle Rd #1053, Schaumburg, IL 60193, United States ("we", "us"). Questions about this policy or your personal data: privacy@glacierpointtech.com.

The service is a web portal at scan.glacierpointtech.com and a Windows program, the collector, that our customers run on their own computers to read the configuration of their Active Directory, Windows hosts and Microsoft 365 tenant.

2. Our two roles

2.1 Controller. We decide how and why we use the personal data needed to run customer accounts, bill, answer enquiries and support requests, and keep the website and portal secure. This policy covers that data.

2.2 Processor. The evidence the collector uploads, the reports made from it, and remediation records are processed on behalf of the customer who ran the collection, on its instructions under our Terms of Service and, where the customer has signed one with us, our Data Processing Addendum (DPA), whose Schedule 2 describes GlacierPoint Scan; the DPA is available on request. The customer decides what to collect. If your account name or address appears in a customer's evidence (for example as an administrator of their tenant), please contact that organization first; we will help it respond. Section 5 describes this data so customers and their staff can see exactly what it contains. Aggregated statistics drawn from assessment results are described in section 3.

3. What we collect as controller

Data	Source	Purpose	Retention
Account: email address, name (at sign-up, the organization name), organization, workspace, role, when created and by whom (your own sign-up or acceptance of an invitation, or our service administrator), last sign-in time; the Terms version you accepted, with the time and IP address of acceptance	You; where our service administrator creates your account at your organization's request, your organization	Provide accounts and workspaces; record acceptance of the Terms	While the account exists; deleted from the live system within 30 days after the workspace is closed (section 9). Each acceptance of the Terms is also kept, on its own schedule, as an agreement record (below)
Invitations: the invited email address, the role offered, the inviting owner's email address, when the invitation was made and when it ends; the invitation link's token is stored only as a hash	The workspace owner who invites you	Send you the invitation and let you accept or decline it by signing in with that address	Until you accept or decline it or the owner revokes it; an invitation not answered stops working after 14 days and is deleted when the portal next clears expired invitations; deleted with the workspace
Authorization records: the account and time that confirmed authorization for each pairing approval and collection package, and that acknowledged each remediation plan	You	Show who authorized each collection and each change	With the report or remediation plan they concern; also as an event in the activity log
Password hash, only if a password was set (scrypt)	You	Sign-in	Until changed or the account is deleted
Sign-in codes and session tokens, stored only as hashes	Generated by us	Sign-in	Codes 10 minutes; sessions 12 hours (a session that can only answer invitations, 1 hour)
IP addresses for rate limiting	Your browser or collector	Prevent abuse and password guessing	Throttle counters are held in memory only, not written to disk; pending sign-up and collector-pairing records keep the address until they expire and are cleared (minutes to about a day)
Activity log: time, account, role, action, short detail, IP address; covers sign-ins, collections authorized, reports, members, invitations (the role only; an invited person appears only when they accept or decline), support access, terms acceptance, reminders sent, purchases, payments, renewals and refunds (never an amount) and remediation events (status and counts only)	Your use of the portal; our support staff and service administrator	Show the workspace what happened; security and support	Most recent 500 events per workspace and never longer than 400 days, while the workspace exists
Administration audit log: time, action, workspace, the account or environment acted on, outcome	Our service administrator's use of the administration console (section 10)	Accountability for our own administrative actions	400 days
Agreement records: who accepted which version of the Terms and when; who authorized which assessment and when; who authorized which Remediation Plan, with the consent text shown and when; who confirmed its operations in the collector, with the consent text shown; who exported a Remediation Plan as a script, with the acknowledgement shown; who confirmed at sign-up that the organization is established in the United States; who placed which order online and when, with the Plan, the price, the renewal choice and the order text shown; and, for a managed service provider, who accepted Terms section 2.2 and when. Each holds the account's email address, the workspace and Environment names, the time, the IP address, the terms version or consent-text identifier and the Remediation Plan's digest; never Evidence or Reports	Your acceptance and authorizations in the portal and the collector	Establish or defend legal claims	Five years after each event, also after the workspace is closed and its other data deleted (section 9)
Purchases: workspace, environment, plan, term, renewal choice, amounts, invoice numbers, dates, the buying owner's email address, the billing country, and Stripe's identifiers for the customer, payment, invoice and subscription; never card or bank details or the full billing address, which only Stripe holds (paragraph "Payments" below)	You; Stripe	Sell and account for plans; keep tax records	7 years after the last payment a purchase records, also after the workspace is closed; an online checkout that was never paid, 90 days
Sales enquiries: name, work email, company, message, IP address	Contact form	Reply to you	Not stored in the portal; kept in our mailbox for 2 years, then deleted
Support requests: subject, message, your email and role, workspace, plan, environments, collector version, a report id you choose	Help page	Answer your request	Kept in our mailbox for 2 years, then deleted; an entry in the activity log
Emails we send: sign-in and sign-up codes, order emails, invitations, renewal and plan reminders to workspace owners, and notices when our service administrator creates an account or adds a member	Generated by us	Deliver codes, order details and invitations; remind workspace owners of renewals and of collections available under their plan	Not kept by us after sending; Microsoft's delivery log holds the metadata for up to 90 days. Which reminder was last sent for a plan, and when, is kept with the plan
Server logs: web server access and error logs (IP address, time, the site name requested, page requested); system and authentication logs of the server; the service's own journal (requests handled and error messages, which can name a workspace or environment)	Your browser; our server	Security and troubleshooting; weekly counts of visits and pages viewed (with referring sites, browser families and countries) that identify no one and are kept 1 year	Web server logs 14 days (rotated daily); system and authentication logs 4 weeks; service journal 90 days
Aggregated statistics: figures such as how often a control fails, compiled across customers' assessment results	Assessment results	Improve the service; publish benchmarks	The statistics identify no one; the results they come from are kept only as section 9 states

We do not ask for or use special categories of personal data, and customers must not submit them (Terms of Service section 12(f)); the collector gathers configuration and directory metadata only.

Invitations. A workspace owner invites a member by entering that person's email address and a role. We then hold the invitation described in the table above and send one email to that address. The email names the inviting owner's email address and name and the workspace's name as that owner entered them, the role offered, a link and the date the invitation ends, and says that no account was created and nothing was shared. Nothing happens unless the person signs in with that address and accepts; only then does an account and membership exist. Accepting, declining or the owner revoking the invitation deletes it; after 14 days the link no longer works.

Emails we send. The service relays its emails (sign-in and sign-up codes, order emails, invitations, reminders, and notices when our service administrator creates an account or adds a member) through Microsoft's mail gateway, Exchange Online Protection, and keeps no sent copy; nothing is stored by us after sending. Microsoft keeps delivery metadata (sender, recipient, subject line, time and delivery status) in its message trace logs for up to 90 days. The subject line of a sign-in or sign-up email does not contain the code; the code is only in the message body. Workspace owners receive reminders about their plans: 35 and 7 days before an Annual or MSP Plan's term ends (Terms of Service section 8.4: for a Plan paid online, the date and, while automatic renewal is on, the amount to be charged and how to turn renewal off; for a Plan paid by invoice, the end date, the price of the next term and how to pay); the day after a Plan paid by invoice ended without the renewal invoice being paid; 7 days before a One-time assessment ends; and, under an Annual or MSP Plan, when a collection is available and the last one is 90 days old. We keep, with the plan, which reminder was last sent and when; the workspace's activity log records each reminder sent or failed, without email addresses. Stripe sends its own receipts and its own emails about a failed payment or an expiring card.

Payments. Online payments are made on Stripe's hosted checkout page. Card and bank details are entered there and never reach us. Stripe receives the buying owner's email address and name, the workspace's name, the billing address, the Plan and the Environment's name (domain or tenant) and the amount, and keeps the saved payment method for a Plan that renews automatically. Stripe processes this as an independent controller of the payment data it collects, under its own terms and privacy policy; it is not our subprocessor (section 6). We keep the purchase records described in the table above.

Aggregated statistics. We may compile statistics from assessment results across customers to improve the service and to publish benchmarks. We use only aggregates; no customer, organization, environment, domain, tenant, host, account or individual is identified or reasonably identifiable from them; we publish no statistic for a group smaller than 20 organizations (Terms of Service section 10.6); we never disclose raw evidence; and we do not use customer evidence to train machine-learning models.

4. Cookies and browser storage

The portal sets one strictly necessary cookie, scanner_session, when you sign in. It holds a random session identifier, lasts 12 hours, is marked HttpOnly and SameSite=Lax, and is Secure over HTTPS. The sign-in and sign-up pages keep your progress (including the email address you typed) in your browser's session storage, which is cleared when you close the tab, and the dashboard remembers whether you hid the sample report in local storage.

We use no advertising, analytics or tracking cookies, and the website loads no scripts or fonts from third parties.

5. Assessment evidence (processed for customers)

5.1 How it travels. The collector encrypts the evidence on the customer's computer (AES-256-GCM with a new key for each collection, wrapped with the portal's RSA-3072 key) and uploads it over TLS. We decrypt it on the server, check it against a fixed schema that rejects unexpected fields, evaluate it, and keep the validated evidence with the reports for the retention period. The encrypted upload itself is not kept.

5.2 What it contains. Mostly settings and counts. Personal data is limited to the following:

Track	Personal data in the evidence
Active Directory	For up to 200 user and 200 computer accounts: account name (sAMAccountName), account-control flags, whether it is in Domain, Enterprise or Schema Admins, whether it has a service principal name, when its password was last set, and its last logon timestamp. Member counts of the three administrator groups. Names of accounts that illustrate a finding (for example privileged users outside Protected Users, or computers with expired LAPS passwords).
Windows hosts (up to 100 per collection, plus the computer running the collector)	Host name and domain; operating system; names of members of the local Administrators group; installed updates with dates; share names and local paths; machine-wide installed software (name, version, publisher); the name of the built-in administrator account; names of applied group policies; whether listed network services answer.
Microsoft 365: tenant	Tenant ID, organization name and domains; the signed-in administrator's user principal name (UPN) and directory roles; licenses. Named examples, capped: UPNs of Global Administrators and synced administrators (up to 20 each), of break-glass account candidates (up to 5), of privileged users without a strong sign-in method (up to 20), and of users and guests with no sign-in for 90 days (up to 10 each); names of applications and service principals with risky credentials or roles; Conditional Access policy names.
Exchange Online and Purview	The UPN used to connect; UPNs (up to 10 each) of mailboxes that forward outside the organization, have inbox rules that forward externally or delete messages, or are shared mailboxes allowing sign-in; names of transport rules, connectors and policies. Forwarding destinations and rule contents are not uploaded, only counts.
SharePoint, Defender, Teams	Tenant-level settings; Secure Score; counts of open security alerts and incidents; names of third-party storage providers. No user-level data.
Remediation	The plan (selected controls, operations, current values), the account that created and authorized it, and the receipt: each changed setting's value before and after, and IDs of created objects. A journal with the same information and the administrator's UPN stays on the customer's computer.

5.3 What it does not contain. We checked the collector's code for each of these:

No passwords, password hashes or Kerberos keys: the directory attributes read are listed in the collector, and none holds a secret. LAPS is checked through expiry times only, and Group Policy Preferences files are checked for the presence of a stored password, which is neither decrypted nor kept.
No email messages, attachments, files, documents or Teams chats: the Microsoft Graph permissions requested are read-only directory, policy, report and security permissions with no mail, file or chat access, and the Exchange and Teams commands read configuration. Inbox rules are read on the customer's computer, and only counts and mailbox names are uploaded.
No sign-in or audit log entries: the last sign-in date of each user is read on the customer's computer to count inactive accounts, and only the counts and the capped examples above are uploaded.
No contents of security alerts or incidents, only counts.
No Microsoft sign-in tokens: they stay in the collector's memory on the customer's computer.
No usage telemetry from the collector.

We do not sell personal data, and we do not share it for advertising. We share it only with these subprocessors, with Stripe for payments (below), with our professional advisers under confidentiality, and where the law requires.

Subprocessor	Purpose	Location
GreenCloud	Hosts the portal server (a single virtual machine) and its database	Buffalo, New York, United States
Backblaze (B2)	Stores off-site backups in a private bucket; the backups are encrypted on our server before upload, and Backblaze also encrypts the stored files	United States (US East region)
Microsoft (Microsoft 365)	Relays the emails we send (sign-in codes, order emails, invitations, reminders), which leave our server over an encrypted connection, without keeping a sent copy for us, and holds our sales and support mailboxes	United States

Stripe, Inc. takes online payments (card and bank debit) on its own checkout page, sends receipts and failed-payment emails, and keeps the saved payment method for automatic renewal. It does so as an independent controller of the payment data it collects, under its own terms and privacy policy, not as our subprocessor; it receives what the "Payments" paragraph of section 3 lists and never assessment evidence or reports. Payment details go to Stripe, not to us. Stripe operates in the United States and other countries.

The current list, with what each subprocessor can see, is published at scan.glacierpointtech.com/subprocessors. When a customer assesses Microsoft 365, the collector talks to the customer's own Microsoft tenant, and may install Microsoft's PowerShell modules from the PowerShell Gallery; those are the customer's relationships with Microsoft, not our subprocessing. We update the published list and email a customer's workspace owners at least 30 days before a new subprocessor starts processing the personal data we process for that customer. The customer may object on reasonable data protection grounds within that period by writing to privacy@glacierpointtech.com; we will discuss the objection in good faith, and if we cannot resolve it, the customer may end the affected Plan before the change takes effect and receive a pro-rated refund of the fees prepaid for the unused part (Terms of Service section 10.2; a signed DPA says the same in its section 6.2).

7. Where we operate

GlacierPoint Scan is offered to organizations established in the United States (Terms of Service section 1.3). We are based in the United States, and the data described in this policy is stored and processed in the United States: our server is hosted in a data center in Buffalo, New York; our encrypted off-site backups are stored by Backblaze in its US East region; and our email, including our sales and support mailboxes, is held by Microsoft in the United States. No backup copy is kept outside the United States. The service is not directed at organizations or individuals in the European Economic Area, the United Kingdom or Switzerland.

8. How we protect data

TLS 1.2 or later for the website and portal, with HSTS; encryption of evidence on the customer's computer before upload.
Each collection needs a one-use approval code and a ticket that expires after 30 minutes; remediation plans are signed and the collector accepts only plans signed with our pinned key, and runs only operations of a remediation catalog signed with a separate key that our server does not hold.
Sign-in codes and sessions are stored only as hashes, passwords as scrypt hashes; sign-in, sign-up, code and contact requests are rate-limited, and repeated wrong passwords lock password sign-in for that account for 15 minutes (sign-in with an emailed code is limited by a daily count of wrong codes instead).
The server accepts SSH with keys only, blocks repeated SSH failures, and allows only web and SSH traffic; the service runs as an unprivileged, sandboxed user; database files are readable only by that user.
Stored records are encrypted in the database (AES-256-GCM) with a key kept in a separate file on the server; record identifiers such as email addresses and report ids are not.
Nightly backups are encrypted before they leave the server and are stored in a private bucket, which the storage provider also encrypts.
Mail from our server to Microsoft is sent over an encrypted connection (STARTTLS).
Workspace activity, including support access, is logged.
If a breach of security affects personal data we hold, we tell the affected customers without undue delay so that they can meet their own duties, and we notify the people affected and the authorities where the law requires it, including under the Illinois Personal Information Protection Act. For the evidence and reports we process for a customer, we notify that customer without undue delay, as a signed DPA says.

We do not claim any security certification.

9. Retention and deletion

Reports and evidence are kept for 30 days (preview and One-time) or 12 months (Annual and MSP). The period runs from the report's creation or, for a report that already exists when a plan is purchased, from the purchase if that is later; a purchase never shortens it. They are then removed from access and deleted from the database.
Remediation plans and receipts are kept as long as the report they belong to. Remediation events (plan created, authorized, claimed, receipt, verified) also appear in the activity log, with the status and counts only.
Account and workspace data is kept while the workspace exists and deleted from the live system within 30 days after it is closed, at the customer's request or by us under the Terms of Service, except records we must keep by law; it then leaves the backups as described below. The portal has no self-service deletion yet: write to privacy@glacierpointtech.com and we will delete a workspace or an account on request. Agreement records (section 3) are kept for five years after each event, also after the workspace is closed, to establish or defend legal claims. An account's email address that appears in a workspace's reports, for example as the person who authorized a collection, stays in those reports until they expire.
Purchases are kept as tax records for 7 years after the last payment they record, also after the workspace is closed; an online checkout that was never paid is deleted after 90 days.
Backups run nightly: copies on the server are kept 7 days; off-site copies, encrypted before upload, are kept as 7 daily, 4 weekly and 3 monthly snapshots, pruned once a month, and the storage provider deletes removed backup files 30 days after their removal, so deleted data is gone from the backups within about four months. Backups are used only for recovery.

10. Support and service administrator access

Our support staff can see a customer workspace only after an owner grants access for a set time (1 to 168 hours). The access is read-only, ends when the time runs out or the owner revokes it, and the start and end of each support session and every report download by support are recorded in the workspace's activity log.

The person who administers the service for us (our service administrator) uses an administration console to unlock purchases, manage members and delete workspaces or accounts on request. The console cannot be reached from the internet, only from the server itself over an encrypted connection. Without a support grant it shows workspace metadata: members (email address, role, whether active, last sign-in, Terms version accepted), environments and plans, report ids, dates and stored sizes, remediation plan ids and status, the support grant's state and recent activity events. It never shows report contents, evidence, per-host results or remediation values; seeing those still requires the owner's support grant. Actions of our service administrator that change a workspace, such as an unlock, a member change or an account deletion, appear in its activity log, and every action of our service administrator is kept in our administration audit log for 400 days.

11. Your rights

11.1 Everyone. Write to privacy@glacierpointtech.com to ask what personal data we hold about you, to have it corrected or deleted, or to receive a copy of it, or to make any other request that the law of your state gives you. We may need to verify your identity and will reply within the time the law allows. The portal does not let you delete or export your account yourself: send the request by email and we do it for you. For data in a customer's evidence or reports, we pass your request to that customer, whose processor we are.

11.2 California. If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you rights to know, delete and correct personal information and to opt out of its sale or sharing, where that law applies to a business. We do not sell or share personal information (section 12). We are below the revenue and volume thresholds at which that law applies to a business; we watch them and will put the California-specific notices and request channels in place if we reach one. Until then we answer requests from California residents under section 11.1.

11.3 Illinois. The Illinois Personal Information Protection Act governs how we notify a breach of security (section 8). We do not collect biometric identifiers or biometric information.

12. No sale, no advertising, no AI training, no automated decisions

We do not sell or rent personal data or share it for cross-context behavioral advertising. We do not use customer evidence or reports to train artificial intelligence or machine-learning models. The reports are produced by rules applied to configuration; we make no decisions about individuals that have legal or similarly significant effects.

13. Children

The service is for organizations and is not directed at children under 16. We do not knowingly collect their personal data.

14. Changes

We will post changes here with a new effective date, and tell workspace owners by email of material changes before they apply.

15. Contact

GlacierPoint Technologies LLC, 1043 S Roselle Rd #1053, Schaumburg, IL 60193, United States. Privacy: privacy@glacierpointtech.com. Support: support@glacierpointtech.com.