Privacy Policy

Last Updated: June 26, 2026

1. Information We Collect

BruteSight collects data from multiple sources, including data voluntarily submitted by users and data automatically observed through the operation of our honeypot network and API services. The categories of data we collect include:

• Personally Identifiable Information (PII): Email addresses, account credentials (stored as hashed values), and any other identifying information you provide during registration or account management.
• Network Telemetry: IP addresses, port numbers, protocol identifiers, usernames, passwords, and payloads observed during brute-force and intrusion attempts captured by our honeypot infrastructure. This data may include credentials or identifiers belonging to individuals or automated systems.
• Agent-Submitted Log Data: IP addresses, timestamps, usernames, and metadata submitted to our ingestion API by operators running the BruteSight agent on their servers. This may include partial PII such as usernames attempted in authentication attacks.
• API Usage Data: Request timestamps, API key identifiers, endpoints accessed, response codes, and source IP addresses, collected for service monitoring and abuse prevention.
• BGP Session Data: Router IP addresses, Autonomous System Numbers (ASNs), and TCP session metadata associated with BGP peering sessions.
• Device and Browser Information: Browser type, operating system, and session identifiers collected automatically when you access the website.

2. How We Use Your Information

We use the data we collect to:

• Provide, operate, and maintain the Service.
• Generate and distribute threat intelligence feeds.
• Authenticate users and manage API access.
• Monitor, analyse, and improve our services.
• Detect and prevent abuse, fraud, and unauthorised access.
• Comply with legal obligations.

3. Data Sharing

We do not sell your personal data. Aggregated threat data — including attacker IP addresses, ASNs, and attack frequency statistics — is shared publicly as part of our core threat intelligence service. Raw PII submitted through the API (such as usernames captured in attack logs) may appear in aggregated or anonymised form within threat feeds.

4. Data Storage and Location

All data collected by BruteSight, including PII and network telemetry, is stored on servers physically located in India. By using this Service you consent to the transfer, processing, and storage of your information in India. Data is retained for as long as necessary to provide the Service and may be retained indefinitely for historical threat intelligence purposes.

5. Data Removal Requests

If you would like to request the removal of your personal data or any data associated with your account or IP address, please contact us at [email protected]. We will endeavour to respond to all data removal requests within a reasonable timeframe. Please note that data submitted as part of threat intelligence feeds (e.g. attacker IP addresses observed across the honeypot network) may not be removable as it forms part of an aggregated, multi-source dataset.

6. Security

We implement reasonable technical and organisational measures to protect data against unauthorised access, loss, or disclosure. However, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security of your data.

7. Governing Law & Jurisdiction

This Privacy Policy is governed by the laws of India. All disputes arising from this policy are subject to the non-exclusive jurisdiction of the courts in Mumbai, India.

8. Contact

For any privacy-related queries, data removal requests, or concerns, please contact: [email protected]