Privacy & Data Governance.

At Gladius, we provide an AI-native autonomous security operations platform designed to hunt threats and remediate risks at machine speed. Trust, transparency, and data sovereignty are the foundations of our unified defense strategy. This Privacy and Data Governance Statement outlines how we collect, process, and protect data across our public website, as well as through the proprietary sensors and connectors that power our platform.

We act strictly as a trusted data processor and security partner for our clients. Under no circumstances does Gladius sell, rent, or share your data, network telemetry, or metadata with third parties. Your data remains strictly under your organizational control and is leveraged exclusively to fortify your own defenses.

We practice data minimization, collecting only what is strictly necessary to secure your environment and optimize our platform.

The operational data and metadata gathered by our sensors and connectors are analyzed by our Agentic AI to secure your environment. We utilize this data to:

• Generate and Refine Defense Recipes: We analyze attack campaigns and telemetry metadata to continuously build, test, and deploy automated defense recipes. These recipes combine red and blue team intelligence to adapt to evolving threats and execute rapid remediation at machine speed.
• Maintain Real-Time Observability: Data is processed in real time to detect threats, validate vulnerabilities, and trigger built-in safety controls that maintain the integrity of your environment.
• System Optimization: Telemetry metadata is used to train and improve the precision of our AI copilot and autonomous defense algorithms. This internal optimization is conducted using aggregated, non-identifiable metadata to ensure broader platform efficacy without compromising individual client privacy.

We recognize that robust security requires transparent, enterprise-grade governance. Gladius is built to align with stringent regulatory frameworks, supporting SOC 2 and HIPAA compliance requirements.

• Data Isolation & Encryption: All telemetry and metadata transmitted from your environment to the Gladius platform are encrypted in transit and at rest using industry-standard protocols. Client data is logically isolated to prevent cross-contamination.
• Retention Minimization: We only retain platform telemetry data for the period necessary to investigate incidents, refine our defensive recipes, and comply with agreed-upon client data retention policies. Once this period expires, telemetry is securely purged.
• Access Controls: Access to client telemetry is restricted to authorized Gladius SecOps personnel on a strict least-privilege basis. All internal access is logged, authenticated, and routinely audited.

As a user of the Gladius platform, you maintain full ownership of your data. You retain the right to:

• Configure sensor and connector scopes to limit data ingestion to specific network segments, devices, or endpoints.
• Review, export, or request the deletion of platform telemetry data in accordance with your organization's data retention and compliance policies.
• Opt out of non-essential website tracking via our centralized cookie management portal.

For questions regarding data privacy, security controls, or to request our SOC 2 compliance documentation, please contact our Data Privacy and Governance Team at privacy@gladiussec.co.