Kosmic Eye Privacy Policy

1. Introduction and scope

This Privacy Policy explains how Tek Yantra Inc. ("Tek Yantra", "we", "us" or "our") collects, uses, shares and protects personal information in connection with Kosmic Eye, our cloud security posture management product, including when you find, deploy or buy Kosmic Eye through the Microsoft Azure Marketplace, contact us for support, or visit our website.

Kosmic Eye helps security teams discover cloud resources, identify misconfigurations and risks, and continuously improve their security posture. Because of how it is deployed, most of the data Kosmic Eye works with never reaches Tek Yantra. Section 3 explains this in detail.

2. Who we are

Tek Yantra Inc. is the publisher of Kosmic Eye and is responsible for the personal information described in Section 5.

3. How Kosmic Eye handles your data

Kosmic Eye is delivered as an Azure Marketplace solution that is deployed inside your own Microsoft Azure subscription. It runs on an Azure Kubernetes Service (AKS) cluster that you own, in a resource group that you control.

3.1 What stays in your subscription

The following data is processed and stored only within your Azure subscription and the Kosmic Eye cluster deployed there:

• Cloud resource inventory: the list of Azure resources Kosmic Eye discovers and their configuration.
• Resource change events: when a resource in your subscription is created, updated or deleted, Azure Event Grid delivers an event to Kosmic Eye inside your cluster. Events that cannot be delivered are kept in a storage account in your subscription.
• Security findings and reports: misconfigurations, risks, attack paths and posture scores.
• Logs and security events: that you connect to Kosmic Eye.
• Product databases: the messaging, graph and document databases Kosmic Eye uses, which run inside your cluster.
• Secrets: passwords and keys Kosmic Eye needs are generated in, and stored in, an Azure Key Vault in your subscription.

3.2 What access Kosmic Eye has

• Kosmic Eye reads your Azure resources using a managed identity in your subscription with the built-in Reader role, which is read-only.
• Kosmic Eye authenticates with Azure managed identities and Workload Identity. No long-lived Azure passwords are stored in the cluster.
• You can review, restrict or remove these permissions at any time in the Azure portal.

3.3 Removing your data

Because the data lives in your subscription, you control its lifecycle. Deleting the Kosmic Eye resource group, cluster and related resources from your subscription permanently removes the data described in 3.1. Tek Yantra holds no copy to delete.

4. Our role and your role

Your deployment data (Section 3): you decide what Kosmic Eye processes in your subscription and you control that data. Tek Yantra does not process it on your behalf.

Account, billing and support information (Section 5): Tek Yantra is responsible for this information and handles it as described in this policy.

5. Information we collect

We collect only the personal information we need for the purposes in Section 6.

We do not ask for, and ask you not to send us, sensitive personal information (such as health, biometric or financial account data) through support channels. If you share log extracts with us for support, please remove personal information they do not need to contain.

6. How we use information

We use personal information to:

• provide Kosmic Eye to you, including setting up your purchase and managing your account;
• process billing through Microsoft Azure Marketplace;
• respond to support requests and troubleshoot issues you report;
• tell you about product updates, security issues, service changes and end-of-support notices;
• protect our systems and users, and prevent fraud or misuse;
• comply with legal, tax and accounting obligations.

We do not sell personal information, and we do not use it for third-party advertising. We record the business purpose of the information we hold and do not use it for unrelated purposes without telling you.

7. Legal bases for processing

Where data protection laws such as the GDPR or UK GDPR apply, we rely on:

• Contract: to provide Kosmic Eye and support you have requested;
• Legal obligation: to keep billing and tax records and respond to lawful requests;
• Legitimate interests: to secure our systems, improve our support, and send you service-related messages, balanced against your rights;
• Consent: for optional marketing communications. You can withdraw consent at any time.

8. How we share information

We share personal information only when it is needed, and only the information that is appropriate for the purpose:

• Microsoft: to process Azure Marketplace transactions and billing. Microsoft handles that information under its own privacy statement.
• Service providers: companies that help us run our business, such as email, support ticketing and cloud hosting providers. Every provider that stores or processes our data is approved by us before use, signs contract terms that require it to protect the data and apply cybersecurity safeguards, must promptly tell us about any significant security incident, and is assessed and monitored for as long as it works with us.
• Legal and safety reasons: when required by law, regulation or valid legal process, or to protect the rights, property or safety of Tek Yantra, our customers or others.
• Business transfers: if Tek Yantra is involved in a merger, acquisition or sale of assets, personal information may be transferred under the protections of this policy.

We keep a record of the third parties that receive personal information.

9. How we protect information

We maintain a documented cybersecurity program based on SANS / Cybersecurity Risk Foundation policy standards. Its safeguards include:

• Encryption: data is encrypted in transit using TLS with properly signed certificates, and at rest. We use only publicly reviewed, industry-standard algorithms such as AES for symmetric encryption, RSA or Elliptic Curve Cryptography for asymmetric encryption, and SHA-256 for hashing.
• Least-privilege access: access to systems and data is based on documented roles, separation of duties and the principle of least privilege. Access rights and role memberships are reviewed regularly, and changes to them are logged and alerted.
• Identity security: user accounts are managed through a documented identity process; passwords are stored only hashed and encrypted.
• Credential protection: passwords, keys and database credentials are never stored in clear text or in source code; they are kept in secure vaults.
• Logging and monitoring: our systems and cloud services produce security logs, which are collected centrally, reviewed regularly, alerted on, and accessible only to authorized staff.
• Secure development: Kosmic Eye's source code is reviewed for security vulnerabilities, and our infrastructure is scanned and patched under a vulnerability management process.
• Cloud configuration: each cloud service we use has a security configuration baseline and is scanned for misconfigurations.
• Backups and resilience: backups are made regularly, access-controlled, protected against deletion, and tested; business continuity and disaster recovery plans are documented and exercised.
• Staff: our employees and contractors receive cybersecurity and privacy training and are bound by confidentiality and acceptable-use rules.

No method of transmission or storage is completely secure, but we work continuously to protect the information we hold.

10. Artificial intelligence

Kosmic Eye's AI features use a model that runs inside your environment. Your deployment data is not sent to public or third-party AI services.

Within Tek Yantra, we do not put personal information, confidential information or customer data into open (public) AI systems. Any AI system we use is reviewed and approved internally, used for documented purposes, and overseen by people.

We do not use your deployment data to train AI models.

11. Security incidents

We maintain a documented incident management plan that defines roles, classification, investigation and root-cause analysis. If a security incident affects personal information we hold, we will notify the affected individuals and customers without undue delay, and notify regulators or other authorities where the law requires.

Because your deployment data is stored in your subscription, you remain in control of monitoring and responding to events in your own environment.

12. How long we keep information

We keep personal information only as long as needed for the purposes in Section 6, or as required by law. We set retention periods for each type of information and archive or delete it when the period ends.

When information is no longer needed, we delete it or make it anonymous.

13. Your rights and choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you and receive a copy;
• Correct information that is inaccurate or incomplete;
• Delete your information (the "right to be forgotten"), unless we must keep it by law;
• Restrict or object to certain uses, including direct marketing;
• Portability: receive your information in a commonly used format;
• Withdraw consent where we rely on consent;
• Update your preferences for the communications you receive from us;
• Complain to your local data protection authority.

To make a request, email info@tekyantra.com . We may need to verify your identity before acting on it. We record each request and our response, and reply within [30] days.

You can unsubscribe from marketing emails at any time using the link in the email.

For data in your own Kosmic Eye deployment (Section 3), you can access, correct or delete it directly in your Azure subscription.

We also welcome feedback about how we use data and any privacy concerns you have.

14. International transfers

The information in Section 5 is stored in [country / Azure region].

If we transfer personal information outside the country where it was collected, we use appropriate safeguards required by law, such as [Standard Contractual Clauses].

Your Kosmic Eye deployment data stays in the Azure region you choose when you deploy.

15. Cookies and our website

[Describe the cookies and analytics your website uses and how visitors can control them, or state: "Our website does not use cookies other than those strictly necessary for it to work."]

16. Children

Kosmic Eye is a business product and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.

17. Changes to this policy

We may update this policy as our product, practices or legal requirements change. We will post the updated version on this page with a new "Last updated" date and, for significant changes, notify customers by email or through the Azure Marketplace listing.

18. Contact us

For questions about this policy or to exercise your rights:

Email: info@tekyantra.com

Post:
Tek Yantra Inc.
1835 Iron Point Rd, Folsom, Suite 100, CA 95630 Suite 100