Who this covers
Avertix Cyber Inc. ("Avertix", "we") is a cybersecurity consulting firm based in Moncton, New Brunswick, Canada. This policy covers the website at avertix.ca and the contact form on it.
It does not cover the engagement agreements we sign with clients. Those set their own confidentiality terms.
What we collect
We collect nothing until you choose to contact us. There is no account, no login and no profile.
If you send the contact form, we receive what you type into it:
- Your name, the name of your business and your email address. These three are required.
- Which service you are asking about and your message. Both are optional.
The notification that reaches our mailbox also includes your IP address, the date and time, and your browser's user-agent string. This is standard context for spotting abuse of a public form.
Like most web servers, our hosting provider keeps ordinary access logs, which record IP addresses, the pages requested and the time. We use them only to run and secure the site.
We use no analytics. There is no tracking script, advertising pixel or measurement product on this site. We do not know how many people visit or which pages they read.
Every file this site loads, including its fonts, comes from our own server. Loading a page does not send your IP address to any third party.
Cookies
This site sets no cookies.
Why we have it, and what we do with it
We use what you send to reply to your enquiry, to prepare for any conversation that follows, and to keep an ordinary business record of it. That is all.
When you send the form, we email a short confirmation to the address you entered. It repeats your first name and the service you chose, not your message. We do not add you to a mailing list or send marketing you did not ask for. We do not sell, rent, trade or otherwise disclose your information to anyone for their own purposes.
Under PIPEDA our basis is your consent, which you give by choosing to send the form. You can withdraw it at any time. See "Your rights".
Who else handles it
Only one kind of service provider receives anything:
- Our web and email hosting providers. They store this site, run the form, and carry and store the email it sends.
No scheduling, analytics, chat, advertising or font service is involved.
Abuse prevention and retention
The form has to stop bots, and stop anyone using it to flood our mailbox or to send confirmation emails to strangers. It does that without a CAPTCHA or any outside service:
- A signed form token. When you start filling in the form, your browser asks our server for a token. It is a signature over the time and a hash of your IP address and browser string. Nothing is stored for it. A submission without a valid, recent token is refused.
- Per-visitor limits. Each visitor can request 30 tokens and send five submissions an hour, at least 20 seconds apart. To count these we store a SHA-256 hash of your IP address, not the address itself, with the times of recent requests. Entries are deleted once an hour has passed since the last one.
- A cap on confirmation emails. Any one email address can receive at most two confirmations a day. To count them we store a SHA-256 hash of the email address with the send times. Entries are deleted after 24 hours.
- A site-wide limit on submissions per hour. It stores only a count and times, nothing about you.
- A mail-domain check. Our server asks the public DNS whether your email address's domain can receive mail. Only the domain is looked up, never the full address.
- A link filter. Messages containing three or more web links are refused, because that is what most form spam looks like.
Enquiries arrive as email and are kept for up to 24 months, so we can reply, carry out any work that follows and keep a business record. After that they are deleted. If you want yours deleted sooner, ask and we will delete it.
Your rights
Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) you may ask us to:
- tell you what personal information about you we hold, and give you access to it
- correct anything that is inaccurate or incomplete
- delete what you sent us
- withdraw your consent to our holding it at all
Write to info@avertix.ca and we will respond within thirty days. There is no charge.
If you are not satisfied with how we handle your request, you can complain to the Office of the Privacy Commissioner of Canada.
Security
The site is served over HTTPS and sends a content security policy that only lets pages load files from our own server. The form rejects submissions from other websites and is rate limited. Personal information you send us is seen only by the people at Avertix who need it to reply.
No transmission over the internet is perfectly secure, and we will not claim otherwise. If you have something sensitive to tell us, ask for an encrypted channel before you send it. Do not put it in the form.
Changes to this policy
If we change how the site handles personal information, we will update this page and the date at the top.
Contact
Avertix Cyber Inc., Moncton, New Brunswick, Canada. info@avertix.ca