Cordon Cybersecurity (“Cordon,” “we,” “us,” or “our”) operates the Cordon email-security, threat-detection, and compliance platform (the “Service”) at cordoncybersec.us. This Privacy Policy explains what information we collect, how we use it, and the choices you have.
By using the Service you agree to the practices described here.
1. Who we are
The Service is provided by Cordon Cybersecurity, based in Tulsa, Oklahoma and Dallas, Texas, USA. For privacy questions, contact us at paakowansah@icloud.com.
2. Information we collect
Account information. When you create an account we collect your name, email address, organization name, and a securely hashed password. We do not store your password in plain text.
Content you submit for analysis. To analyze email you provide, we process message headers, sender and recipient addresses, authentication results (SPF, DKIM, DMARC), body text, links, and attachment metadata. To detect intrusions and data exfiltration, we process the activity and event logs you submit (for example login events, access events, and transfer volumes).
Data minimization. By design, Cordon does not retain the raw content of analyzed emails by default. We retain the detection results, findings, risk scores, and control mappings needed to provide the Service and its audit evidence, and we minimize the underlying raw data we keep.
Usage and technical data. We collect standard technical information such as log data, device and browser type, and timestamps to operate and secure the Service.
We do not sell your personal information, and we do not use your submitted email or activity data to train third-party AI models.
3. How we use information
We use the information above to: provide and operate the Service; detect, score, and explain security threats; generate compliance and audit evidence; secure and maintain the platform; communicate with you about your account and the Service; and comply with legal obligations.
4. How the AI analysis works
Cordon uses a third-party large-language-model provider (Anthropic) to generate the plain-English analyst narrative that accompanies a detection. Only the limited data needed to produce that explanation is sent to the provider, over an encrypted connection, and it is not used by the provider to train its models. The deterministic rules and machine-learning scoring run within Cordon’s own systems.
5. Sub-processors
We rely on a small set of vetted service providers to run the Service. As of the date above these include:
- •Anthropic: AI analysis (the analyst narrative).
- •Render: application hosting and managed database (United States).
- •Vercel: hosting for the web application and marketing site (United States).
- •Mailgun: transactional and authorized phishing-simulation email delivery.
- •Cloudflare: DNS and network protection.
A current list of sub-processors is available on request. We require each to protect data consistent with this Policy.
6. Phishing simulation data
If your organization runs authorized phishing-simulation campaigns, Cordon records only whether each recipient opened, clicked, or reported a simulated message, and a resulting human-risk score. Cordon never captures or stores real passwords or credentials entered on a simulation page. There is structurally no field to store them. Simulations can only target recipients on a domain your organization has verified it controls, and require administrator authorization.
7. How we protect information
We apply security measures appropriate to a security product, including: encryption of data in transit (TLS/HTTPS); Argon2id password hashing; strict per-account data isolation (one customer cannot access another’s data); access controls and audit logging; and data minimization. No method of transmission or storage is 100% secure, but we work to protect your information and continually improve our posture.
8. Data retention
We retain account information for as long as your account is active. Detection results and audit evidence are retained for the period needed to provide the Service and meet your compliance needs, after which they are deleted or anonymized. You may request deletion as described below.
9. Your rights and choices
Depending on where you live, you may have rights to access, correct, delete, or port your personal information, to object to or restrict certain processing, and to withdraw consent. To exercise any of these, contact us at paakowansah@icloud.com. We will respond consistent with applicable law (including GDPR and CCPA/CPRA where they apply). Where your organization is our customer, we may direct certain requests to that organization as the data controller.
10. International users
The Service is operated in the United States. If you access it from outside the U.S., your information will be processed in the U.S. Where required, we use appropriate safeguards for international transfers.
11. Children
The Service is not directed to children and is intended for business use. We do not knowingly collect personal information from anyone under 18. Where Cordon processes data for a school or similar institution, it does so on that institution’s behalf and under its direction.
12. Changes to this Policy
We may update this Policy from time to time. We will post the updated version with a new “Last updated” date and, for material changes, provide additional notice.
13. Contact
Questions about this Policy or your data: paakowansah@icloud.com. Cordon Cybersecurity, Tulsa, Oklahoma and Dallas, Texas, USA.