Pistos Privacy Policy

Last updated: October 3, 2026

This Privacy Policy explains how ITG Security LLC dba Pistos Trust Labs ("Pistos", "we", "us", or "our") collects, uses, shares, and protects personal information in connection with the pistos.io website, the Pistos vendor risk and compliance management platform, Trust Center pages hosted on our platform, our APIs, and related services (together, the "Services").

Capitalized terms not defined here (such as "Customer", "Customer Data", "Respondent", "Trust Center", and "Partner") have the meanings given in our Terms and Conditions.

1. Our Role: Controller vs. Processor

Pistos handles personal information in two different capacities:

• Pistos as controller. We decide how and why personal information is used when it relates to our own business. This includes visitors to pistos.io, people who request a demo or contact us, Customer account holders and billing contacts, and prospective partners. This Privacy Policy mainly covers this information.
• Pistos as processor (service provider). When our Customers use the Services, they upload and collect information, including information about their employees, their vendors (Respondents), their Clients, and visitors to their Trust Center. We process this Customer Data only on the Customer's behalf and according to its instructions, as set out in our agreement with that Customer and our Data Processing Addendum at pistos.io/dpa. The Customer is the controller of that information. Its own privacy notice governs how it uses the information.

If you are a vendor completing an assessment, or a visitor to a Customer's Trust Center, the organization that invited you or runs that Trust Center is generally responsible for your information. Please direct privacy requests to that organization. If you contact us, we will forward your request to the relevant Customer where appropriate.

2. Information We Collect

2.1 Information you provide to us

• Contact and demo requests: name, work email, phone number, company name, job title, company size, number of vendors, and any message you send us.
• Account information: name, work email, password or SSO identifiers, role, team membership, and profile preferences for Authorized Users.
• Billing information: billing contact name, billing address, tax identifiers, and payment details. Our payment processor collects and stores payment card details. We do not store full card numbers.
• Support communications: the content of emails, chats, and support tickets, and any attachments you send.
• Partner program information: business and contact details submitted when applying to or participating in our partner program.
• Surveys and feedback: your responses if you choose to take part.

2.2 Information collected through the Services (Customer Data)

Depending on how a Customer configures the Services, Customer Data may include:

• names, work emails, job titles, and roles of Customer personnel and Respondent contacts;
• questionnaire responses, comments, and uploaded evidence (such as policies, audit reports, and certificates), which may contain personal information;
• vendor and asset records, business impact analysis data, and risk ratings;
• results produced by the optional AI-assisted features (suggested findings, assessment summaries, draft risks and recommendations) and a record of each time those features were used (see Section 5); and
• for Trust Centers, visitor names, work emails, companies, access and NDA requests, and records of documents accessed.

We process Customer Data as a processor, as described in Section 1.

2.3 Information collected automatically

When you visit our website or use the Services, we automatically collect:

• Device and log data: IP address, browser type and version, operating system, referring URL, pages viewed, date and time stamps, and error logs.
• Usage data: features used, actions taken in the Services, clicks, and session duration.
• Audit and security logs: login events, changes to settings, and access to records, used to secure the Services and, where included in a Customer's plan, provided to the Customer as audit logs.
• Cookies and similar technologies: see Section 8.

2.4 Information from third parties

• Single sign-on providers: when you log in with SSO/SAML, we receive identifiers and profile attributes from your organization's identity provider.
• Your organization: an administrator may create an account for you or invite you to the Services.
• Partners: MSPs and consultancies may provide information about Client personnel when setting up Client workspaces.
• Vendor monitoring: if a Customer uses continuous vendor monitoring, we collect public technical information about the domains it has chosen and confirmed it may check (public DNS records, the TLS certificate, HTTP response headers, the published security.txt file, public certificate transparency logs, and the public domain registration record) using passive requests that identify Pistos. This is technical information about systems and typically contains no personal data, other than a security contact address a vendor chooses to publish.
• Business and marketing sources: we may receive business contact information from event organizers, referral partners, or publicly available professional sources, in line with applicable law.

3. How We Use Information

We use the information we control to:

1. Provide the Services: create and manage accounts, authenticate users, deliver features, and process transactions.
2. Communicate with you: respond to inquiries and demo requests, provide support, and send service announcements, security notices, and administrative messages.
3. Bill and manage accounts: process payments, manage subscriptions, and enforce plan limits.
4. Secure the Services: monitor for, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms.
5. Improve the Services: analyze usage trends, troubleshoot, and develop new features, mainly using aggregated or de-identified data.
6. Market our Services: send product updates, newsletters, and event invitations to business contacts where permitted by law. You can opt out at any time (see Section 10).
7. Meet legal obligations: comply with laws, regulations, legal process, and tax and accounting requirements, and establish, exercise, or defend legal claims.

We use Customer Data only to provide, secure, maintain, and support the Services for that Customer, as instructed by the Customer and described in our agreement with them. We do not sell Customer Data or use it to market to Respondents or Trust Center visitors. We do not use Customer Data to train or fine-tune AI models, and our agreement with our AI provider does not allow it to do so (see Section 5).

Legal bases (EEA, UK, and Switzerland)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Contract: to provide the Services and manage accounts and billing.
• Legitimate interests: to secure and improve the Services, respond to inquiries, and conduct B2B marketing, where those interests are not overridden by your rights.
• Consent: for non-essential cookies and certain marketing communications. You may withdraw consent at any time.
• Legal obligation: to comply with applicable laws.

4. How We Share Information

We share personal information only as described below:

• Within your organization: information in an Account is visible to other Authorized Users and administrators of that Account according to their permissions.
• Between Customers and Respondents: when you respond to an assessment, your responses and uploads are shared with the Customer that invited you.
• Trust Center: information you submit when requesting access or accepting an NDA on a Customer's Trust Center is shared with that Customer.
• Partners: when a Partner manages a Client workspace, the Partner can access that Client's data within the Services.
• Service providers (subprocessors): we use vendors to host infrastructure, store encrypted backups, process payments, send email, provide customer support tools, and perform analytics. They may use personal information only to perform services for us. Where a Customer uses the optional AI-assisted features, this includes our AI provider (see Section 5). A current list of subprocessors is available at pistos.io/dpa#annex-3-subprocessors.
• Business transfers: in connection with a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred to the successor, subject to this Privacy Policy.
• Legal and safety: when we believe in good faith that disclosure is required by law or legal process, or is needed to protect the rights, property, or safety of Pistos, our users, or others. Where legally permitted, we will notify the affected Customer of any request for its Customer Data.
• With your consent: for any other purpose you agree to.

We do not sell personal information and do not "share" it for cross-context behavioral advertising, as those terms are defined under California law.

5. AI-Assisted Features

The Services include optional features that use artificial intelligence (AI) to help a Customer's personnel with vendor risk work. There are three:

• Suggested findings. On the reviewer screen, the feature looks at one vendor answer and suggests whether it is a finding, with a severity and a draft statement.
• Assessment summaries. The feature reads an assessment round (the vendor's answers and explanations, the findings, and the documents the vendor provided for that assessment) and writes an overall summary with a recommended outcome for the Customer's reviewers to consider.
• Risk suggestions and recommendations. On the vendor risk register, the feature drafts risks from a vendor's open findings and monitoring findings, and recommends how to treat a risk.

Off unless enabled, and started by a person. These features are available only on plans that include them and only after we have enabled them for that Customer. They never run by themselves: each use starts when a Customer user presses a button. We limit how often they can be used, and which roles can use them.

What is sent, and to whom. To produce a result, we send the relevant text to our AI provider, Anthropic, PBC, which acts as our subprocessor and is listed in our subprocessor list. Depending on the feature, that text is:

• for suggested findings: the question, its guidance and expected answer, and the vendor's typed answer and explanation;
• for assessment summaries: the questions, the vendor's typed answers and explanations, the findings, facts about the vendor and the service (such as its tier and the kind of data it handles), and the contents of the documents the vendor provided for that assessment; and
• for risk suggestions and recommendations: the text of open findings and monitoring findings, the text of the risk, and a profile of the vendor (such as tier, rating, criticality, data access, hosting model, category and service description). We do not send the vendor's name, or its documents.

We do not send the names, email addresses or phone numbers of people as separate fields. However, free text that a vendor or reviewer has written, and documents a vendor has provided, can contain personal information, and anything in the text we send goes to the provider with it. Customers should tell Respondents not to put personal information into free-text answers where it is not needed.

How the provider handles it. We do not use Customer Data to train or fine-tune AI models. Under our agreement with the provider, it may not train its models on this content. Its current terms also provide that it deletes inputs and outputs from its systems within a limited period (currently up to 30 days), unless a longer period is required by law or to investigate a violation of its usage policies.

People stay in charge. Results are suggestions and can be wrong or incomplete, so people should check them. Nothing is saved as a finding, a vendor decision or an open risk unless a person at the Customer accepts it. Risks drafted by AI are marked as AI-drafted and wait for an administrator to accept, edit or decline them. We do not use these features to make decisions about individuals, and we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. A Customer's decisions about its vendors are made by its own personnel.

Records. We keep a record of each use (the Customer, the person who used it, the time, the model used and the outcome). The results themselves (a suggested finding, a summary, a drafted risk) are stored with the Customer's records and are Customer Data.

Safeguards. Text from vendors and other third parties is treated as data to be analysed, never as instructions to the AI, and the AI is not given the ability to change anything in the Services. Output is limited to plain text of bounded length.

Your choices. A Customer's administrator can ask us to switch these features off. If you are a Respondent or another individual whose information is in a Customer's records, please contact that Customer about how it uses AI-assisted features, as it is responsible for that information (see Section 1).

6. International Data Transfers

Pistos is based in the United States of America, and our service providers may process information in other countries. Data protection laws in those countries may differ from those where you live. When we transfer personal information from the EEA, UK, or Switzerland to countries not recognized as providing adequate protection, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, or rely on an applicable adequacy framework such as the EU-U.S. Data Privacy Framework where we are certified.

Customer Data is hosted in the United States. Customers on eligible plans may choose an alternative hosting region. Where a Customer uses the AI-assisted features, the text described in Section 5 is processed by our AI provider in the United States.

7. Data Retention

We keep personal information only as long as needed for the purposes described in this Privacy Policy:

• Account and billing information: for the life of the Account, and afterwards as needed for legal, tax, accounting, and dispute-resolution purposes (generally up to 7 years for financial records).
• Customer Data: for the subscription term and for 30 days after termination to allow export, then deleted according to our retention practices. Backups are overwritten in the ordinary course within 90 days. A Customer may ask us to delete its Customer Data sooner.
• AI-generated results and records of AI use: the results are part of Customer Data and are kept for the same period. The record of each use is kept with our other audit and security records. Our AI provider's own retention is described in Section 5.
• Marketing and demo-request information: until you opt out, or for up to 24 months after our last meaningful interaction with you.
• Logs: security and system logs are generally retained for up to 12 months, unless needed longer to investigate an incident.

8. Cookies and Similar Technologies

We use cookies, local storage, and similar technologies on our website and in the Services:

Where required by law, we ask for your consent before setting non-essential cookies. You can change your choices at any time through your browser settings. Blocking some cookies may affect how the website works. We honor Global Privacy Control (GPC) signals as an opt-out where required by applicable law.

9. Security

We use administrative, technical, and physical safeguards designed to protect personal information. These include encryption in transit and at rest, logical separation of Customer data (and of Client data within Partner Accounts), role-based access controls, SSO support, access logging, and regular security reviews. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify you and/or the relevant Customer as required by law and our agreements.

10. Your Choices and Rights

10.1 Choices available to everyone

• Marketing emails: click "unsubscribe" in any marketing email or contact us. You will still receive service and administrative messages related to your Account.
• Account information: Authorized Users can update much of their profile information in the Services. Your organization's administrator may control some settings.
• Cookies: see Section 8.

10.2 Privacy rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you and get a copy of it;
• correct inaccurate information;
• delete your information;
• restrict or object to certain processing, including processing based on legitimate interests and direct marketing;
• data portability;
• withdraw consent where processing is based on consent; and
• not be discriminated against for exercising your rights.

To exercise these rights, email privacy@pistos.io. We will verify your identity before responding and respond within the time required by law. You may use an authorized agent where the law allows, and we may ask for proof of the agent's authority. If we deny your request, you may appeal by replying to our decision.

Automated decision-making. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. The AI-assisted features described in Section 5 only make suggestions to people.

If your information is Customer Data (for example, you are a Respondent, a Trust Center visitor, or an employee of a Customer), please send your request to the relevant Customer, which controls that information. We will help the Customer respond as required by our agreement with them.

EEA, UK, and Swiss residents also have the right to lodge a complaint with their local data protection authority.

10.3 California residents

This section supplements this Privacy Policy for California residents under the California Consumer Privacy Act, as amended (CCPA). In the past 12 months, we have collected the following categories of personal information for the business purposes described in Section 3: identifiers (such as name, email, and IP address); professional or employment-related information (such as company and job title); commercial information (such as subscription and billing records); internet or other electronic network activity (such as usage and log data); and, for account holders, account log-in credentials, which are sensitive personal information and which we use only as permitted by the CCPA. We collect this information from the sources described in Section 2 and disclose it to the categories of recipients described in Section 4. We do not sell or share personal information and have no actual knowledge of selling or sharing the personal information of anyone under 16.

11. Children's Privacy

The Services are intended for businesses and are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

12. Third-Party Links and Integrations

Our website and the Services may link to or integrate with third-party websites and services, such as identity providers or storage tools a Customer chooses to connect. Their own privacy policies govern how they handle your information, and we are not responsible for their practices.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date above. If we make material changes, we will notify Customers by email or through the Services before the changes take effect.

14. Contact Us

If you have questions about this Privacy Policy or our privacy practices, contact us:

ITG Security LLC
30 N Gould St Ste R
Sheridan, WY 82801
USA
Email: privacy@pistos.io

Print or save as PDF