Depending on the services enabled for an organization, Atlas may process the following categories of personal data:
Identity and account information: names, business email addresses, user identifiers, organizational affiliations and access permissions.
Authentication information: authentication metadata and identifiers associated with Microsoft Entra ID sign-in and session management.
Security information: security findings, risk indicators, authentication events, device information, security configurations and other security-related records that may relate to identifiable individuals.
Operational information: assigned remediation actions, action status, comments where supported, and records of user activity within the platform.
Technical information: information necessary to establish secure connections, operate the application, troubleshoot technical issues and protect the platform.
Notification information: notification preferences and, where push notifications are enabled, device registration tokens required for delivery.
The specific categories of information processed depend on the customer's configuration and the security services connected to Atlas.
Personal data is processed where necessary to:
Provide and operate the Atlas platform and mobile application.
Authenticate users and enforce authorization and tenant isolation.
Monitor cybersecurity risks, security posture and configurations.
Present security findings and support remediation workflows.
Generate security-related notifications and operational communications.
Maintain platform security, reliability and auditability.
Provide technical support and investigate incidents.
When synsec processes personal data on behalf of a customer through Atlas, the customer generally acts as the data controller and synsec acts as the data processor, subject to the applicable contractual arrangements.
For personal data that synsec processes for its own business administration, contractual relationships or independently determined purposes, synsec may act as the data controller.
Where synsec acts as a processor, processing is governed by the applicable data processing agreement and the customer's documented instructions.
Atlas uses Microsoft Entra ID for user authentication and authorization.
The platform uses Microsoft Azure infrastructure and may integrate with Microsoft 365 and other cybersecurity services configured by the customer.
Personal data may be processed by authorized technology service providers where necessary to provide the service, subject to applicable contractual and data protection safeguards.
Personal data processed through Atlas is retained according to the applicable contractual arrangements, configured retention policies, operational requirements and legal obligations.
Where synsec acts as a data processor, deletion or return of customer data is governed by the applicable data processing agreement and the customer's documented instructions.
Requests concerning personal data controlled by a customer may need to be directed to that customer.
Atlas uses authentication, authorization, tenant isolation, encrypted communications and other technical and organizational security measures designed to protect the confidentiality, integrity and availability of information.
Access to customer information is restricted according to assigned permissions and applicable operational requirements.
Where synsec acts as the data controller, individuals may exercise their applicable data protection rights using the contact details provided in this privacy policy.
Where synsec processes personal data on behalf of a customer, the customer is generally responsible for handling requests from data subjects, with assistance from synsec where required under the applicable agreement.
