Privacy Policy

1. Who we are and what this policy covers

SYLF LLC ("Securing Your Business," "we," "us," or "our") provides independent cybersecurity assessments and practical security improvements for U.S. businesses, generally those with approximately 5–50 employees that depend on Microsoft 365 and do not have an internal security team.

This Privacy Policy explains what information we collect, why we collect it, how we protect it, and the choices you have. It applies to:

The website at securingyourbiz.com and any subdomains;
The Free Zero-Access Business Exposure Review™;
Free PDF resources and related communication preferences;
Email, phone, and other communications with us; and
Information we handle in the course of delivering paid engagements (the Business Security Baseline, targeted improvements, and Continuous External Monitoring).

This policy does not override any executed engagement letter, master services agreement, or non-disclosure agreement you have with us. Where those documents impose stricter confidentiality or data-handling obligations than this policy, those documents control.

2. Our core commitments, in plain English

Because our clients rely on us to assess sensitive business systems, we hold ourselves to a stricter standard than a typical marketing site. Specifically:

We do not sell your personal information. Ever. We have never sold personal information and we do not share it for cross-context behavioral advertising.
We do not disclose findings about your business to anyone outside our firm. Your exposure review results, assessment findings, configuration details, and remediation evidence are not published, syndicated, resold, listed in a directory, shared with vendors, shared with insurers, or provided to any third party without your written instruction – except in the narrow legally compelled circumstances described in Section 9.
We do not use your findings for advertising or list-building. We may follow up once after your report is delivered; if you are not interested, that is the end of it. We do not use your findings as case studies, testimonials, screenshots, or examples without your specific written permission.
We keep the work in-house. Assessment analysis, report generation, and engagement work are performed by our own personnel. We do not outsource, offshore, or subcontract the analysis of your environment or your findings.
We collect the minimum we need. The free exposure review requires only a business domain and a matching work email. We delete the domain within about an hour of your request, whether or not you complete verification. We keep only the requesting work email for follow-up purposes.
We never access anything private to run a free review. The free exposure review uses only publicly available DNS and web records – no credentials, no logins, no scanning of private systems, no intrusive testing.

3. Information we collect

PDF resources and optional communications

We use your work email to send the requested PDF attachment and help with delivery problems. We record the resource version, delivery status, and communication preference. A keyed hash of your IP address helps limit abuse; the resource database does not store the raw IP. Hosting providers may keep access logs.

If you choose and confirm the optional permission, our staff may send occasional emails about small-business cybersecurity services and resources. These may be personal follow-ups, but are still marketing communications. This is not a newsletter. Requesting the PDF alone does not authorize marketing emails.

The checkbox starts unchecked. Permission takes effect only after you confirm through the emailed link. Leaving it unchecked keeps any existing preference unchanged. Another PDF request does not undo an unsubscribe without new confirmed permission. Unsubscribe using the email link, reply to our email, or use our contact form. This stops marketing, not delivery of a resource you request.

We do not sell your email or share it for others' marketing. Our hosting, database, and email providers process information needed for delivery and storage. Resource request and communication-preference pages do not load our analytics or session-replay tools.

3.1 Information you provide to us

Business domain name – Exposure review, contact forms – used to run the review against the correct business.
Work email address – Exposure review (required), contact – used to verify the request comes from the business itself and to deliver results.
Name, title, phone number – Contact, scoping calls, engagements – used to communicate and scope work.
Business name, size, industry – Scoping and proposals – used to scope an engagement accurately.
Message content – Contact form, email, calls – used to respond to your inquiry.
Billing and payment details – Paid engagements – used to invoice and collect payment.

We do not ask for, and ask that you not send us, sensitive personal information (such as government identifiers, financial account numbers, health information, or biometric data) through our web forms.

3.2 Publicly available technical information

To produce the Zero-Access Business Exposure Review™, we query information that is already publicly published and available to anyone on the internet, including:

DNS records (MX, SPF, DKIM, DMARC, and related records);
WHOIS/RDAP registration data as publicly published;
Publicly resolvable subdomains and hostnames;
TLS/HTTPS certificate transparency data and public certificate metadata;
HTTP response headers and other publicly served web configuration;
Publicly registered domains that closely resemble your business's domain ("lookalike" domains); and
Publicly indexed exposure signals of a similar nature.

We do not authenticate to, log into, scan, probe, or attempt to access any private system, mailbox, tenant, or network to produce a free review. These are passive, read-only queries against public records. Public visibility is not automatically proof of a vulnerability or compromise.

3.3 Engagement data (paid clients only)

If you engage us for the Business Security Baseline, targeted improvements, or Continuous External Monitoring, we will necessarily handle more sensitive material, which may include:

Microsoft 365 / Entra ID tenant configuration, policy, and audit settings;
Email authentication and routing configuration;
User account inventories, group memberships, role assignments, and sign-in policy data;
Device, backup, and administrative control settings;
Delegated or time-bound administrative access credentials you provision to us;
Before-and-after evidence artifacts (screenshots, exports, configuration snapshots); and
Assessment findings, risk ratings, and remediation recommendations.

Scope of access is agreed in writing before work begins. We request the least privilege necessary, for the shortest duration necessary.

3.4 Information collected automatically

When you visit our website we may collect standard technical information such as IP address, browser type and version, device type, operating system, referring page, pages viewed, and timestamps. This is used for site operation, security, abuse prevention, and aggregate traffic measurement.

We use Google Analytics to understand how visitors interact with our website, improve our content, and evaluate site performance. We also use Microsoft Clarity to evaluate and improve website experience by understanding how visitors navigate the site, where they click, how far they scroll, and which site areas may need refinement. Microsoft Clarity may collect information such as page views, click interactions, scroll depth, session recordings, and technical device information such as browser, operating system, and approximate location. Information generated by these tools is transmitted to and stored by Google and Microsoft under their respective privacy terms.

We do not use advertising cookies, retargeting pixels, or third-party trackers that build profiles of you across other websites for marketing purposes.

4. How we use information

To run and deliver the free exposure review you requested;
To verify that a review request comes from the business that owns the domain;
To respond to inquiries and provide requested information;
To email requested PDF resources, resolve delivery problems, prevent abuse, and record communication preferences;
To send occasional service and resource marketing emails where you have separately confirmed permission;
To scope, quote, deliver, document, and support paid engagements;
To produce deliverables for you – reports, evidence, and remediation priorities;
To send the free review verification link to the work inbox that requested it, then deliver the structured results in the browser and by email once verified;
To invoice and collect payment;
To maintain the security, integrity, and availability of our own systems, and to prevent abuse of our free tools;
To improve the quality and accuracy of our own methodology using internal records only, never by exposing an identifiable business's findings; and
To comply with legal obligations and to establish, exercise, or defend legal claims.

We do not use your information for automated decision-making that produces legal or similarly significant effects about an individual, and we do not profile individuals for advertising.

5. Confidentiality of assessment findings

Your findings are yours. Any exposure review result, assessment finding, configuration detail, evidence artifact, gap, weakness, or remediation record associated with your business or your domain is treated as confidential information of your business. We commit that we will not:

Publish, post, or display your findings, in whole or in part, in any public or semi-public forum;
Provide your findings to any other business, competitor, vendor, marketing partner, data broker, threat intelligence feed, insurer, or ranking or scoring service;
Include your business's name, domain, logo, findings, or screenshots in marketing materials, case studies, testimonials, sales decks, or social media without your specific, written, opt-in permission;
Contribute your findings to any shared, industry, benchmarking, or aggregate dataset that is disclosed outside our firm; or
Use your findings for any purpose other than delivering and supporting the services you asked for.

6. We do not sell or share personal information

We do not, and will not, sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (as amended by the CPRA) and comparable state laws. We have not done so in the preceding twelve (12) months. We do not permit third parties to place advertising or tracking technologies on our site for their own purposes.

7. Service providers

We keep analysis and engagement work in-house. Like any business, we rely on a small number of infrastructure and business-operations providers to run the website and communicate with you, including Vercel for front-end web hosting, Railway for backend hosting services, Google Analytics for website analytics, and Microsoft Clarity for website-experience evaluation and improvement.

Providers are bound by written agreements that limit them to processing information only on our instructions and only to provide the service to us;
Providers are prohibited from selling or independently using the information;
We select providers that offer encryption in transit and at rest and maintain recognized security practices; and
We do not send assessment findings, engagement evidence, or client environment data to any provider except as strictly necessary for storage or transmission, in encrypted form, under contract.

8. Requests concerning domains you do not control

The Zero-Access Business Exposure Review™ requires a work email matching the domain requested. You may only submit a domain that your business owns or that you are authorized to request a review for. Submitting another organization's domain without authorization may violate our terms and applicable law.

We log the domain, the submitting email address, IP address, and timestamp for each request during the short verification window, for abuse prevention and to respond to any complaint that a review was requested improperly.

If you believe a review of your business's domain was requested by someone without authority, contact us through our contact form and we will investigate and suppress the domain from future requests on request.

9. Legally compelled disclosure

We will not disclose your information to law enforcement, regulators, or private litigants except where we are legally compelled by a valid subpoena, court order, warrant, or other binding legal process, or where disclosure is necessary to protect against imminent harm.

If we receive such a demand relating to a client's information, and unless we are legally prohibited from doing so, we will notify you promptly, object to overbroad demands, assert any applicable protections, and produce only what is legally required. Where a legal prohibition on notice expires, we will notify you at the earliest permissible time.

10. How we protect information

We apply the same controls to our own environment that we recommend to clients, including:

Multi-factor authentication on all administrative and email accounts;
Encryption in transit (TLS) and encryption at rest for stored findings and engagement data;
Least-privilege access, with engagement data accessible only to personnel working that engagement;
Time-bound, just-in-time administrative access to client tenants, revoked at engagement close;
Endpoint protection and patch management on systems used to deliver services;
Logging and monitoring of access to client data;
Secure deletion procedures at the end of the applicable retention period; and
Written incident response procedures.

Breach notification. If we experience a security incident affecting your information, we will notify you without undue delay and in any event within seventy-two (72) hours of confirming the incident, and we will provide the information you need to satisfy your own notification obligations.

No system is perfectly secure, and we do not claim otherwise. We do commit to being transparent with you if something goes wrong.

11. How long we keep information

Domain submitted for a free exposure review: Deleted within approximately 60 minutes (the email-verification window), whether or not you complete verification.
Free exposure review report contents and scan findings: Delivered after verification through the browser and to the verified work inbox by email; the underlying domain and scan data are not retained beyond the short verification window.
Email address from a free exposure review request: Retained as a lead until you ask us to delete it.
PDF delivery records: Completed or failed requests are deleted once they are more than 90 days old. Pending deliveries remain until resolved.
PDF requester email and preference history: Retained to support requests and document permission. You may request deletion; we may keep a minimal suppression record to honor your opt-out and records required by law.
Other prospect and inquiry contact information: 24 months from last contact, or until you ask us to delete.
Engagement working data (configuration exports, evidence artifacts): Duration of engagement plus 12 months, then securely deleted.
Final deliverables (reports, evidence packages): 3 years, to support your audit, insurance, and vendor-questionnaire needs.
Contracts, invoices, and financial records: As required by law and applicable statutes of limitation, typically 7 years.
Website and security logs: Up to 12 months.

Early deletion on request. At any time after an engagement ends, you may request accelerated deletion of your engagement data and findings via written request. We will comply within thirty (30) days and provide written confirmation of deletion, retaining only what we are legally required to keep.

12. Your choices and rights

Regardless of where you live, you may:

Ask what we hold about you or your business;
Correct inaccurate information;
Request deletion of your information, subject to legal retention requirements;
Request a copy of your information in a portable format;
Opt out of all marketing communications, at any time, by replying to any email or contacting us. We will still send transactional and engagement-related messages;
Withdraw consent where processing is based on consent; and
Request suppression of your domain from future free-review requests.

To exercise any of these, use our contact form with the subject line "Privacy Request." We will acknowledge within ten (10) business days and respond substantively within forty-five (45) days, extendable once where permitted by law. We will verify your identity and authority to make the request before acting.

13. State privacy rights

Residents of California, Colorado, Connecticut, and other states with comprehensive privacy laws have rights that may include access, correction, deletion, portability, opt-out of sale/share/targeted advertising, and opt-out of certain profiling. We extend the rights described in Section 12 to all users regardless of residency, so you do not need to establish residency to exercise them.

Specific California disclosures. In the preceding 12 months we have collected the categories of personal information described in Section 3, from the sources described in Section 3, for the business purposes described in Section 4, and we have disclosed personal information only to the service providers described in Section 7. We have not sold or shared personal information.

Authorized agents. You may use an authorized agent to submit a request; we will require written proof of authorization.

Appeals. If we decline a request, you may appeal by replying to our decision. If your appeal is denied, you may contact your state attorney general.

Global Privacy Control. We honor the GPC browser signal as an opt-out of sale/sharing where applicable.

14. Users outside the United States

We are a United States business and process information in the United States. If you contact us from outside the U.S., your information will be transferred to and processed in the U.S., which may have different data protection laws than your country. We provide strictly U.S.-only services.

15. Cookies and tracking

We use Google Analytics and Microsoft Clarity on this website to understand how visitors interact with our site, how people find our content, and how we can improve the user experience. The information generated by these tools is transmitted to and stored by Google and Microsoft under their respective privacy terms. You can prevent Google Analytics from recognizing your return visits by disabling cookies in your browser settings or by installing the Google Analytics Opt-out Browser Add-on, and you can manage cookie preferences or use Microsoft's opt-out tools where available. Blocking strictly necessary cookies may prevent parts of the site from working.

16. Third-party links

Our website may link to third-party sites and resources. We do not control those sites and are not responsible for their privacy practices. Review their policies before providing information to them.

17. Children

Our services are for businesses. We do not direct our services to children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us information, contact us and we will delete it.

18. Not legal or compliance advice

Our assessments, reports, and findings are informational and technical in nature. They do not constitute legal advice, a legal opinion, a compliance certification, a formal audit, or a penetration test. This Privacy Policy is a description of our practices and is not legal advice to you.

19. Changes to this policy

We may update this policy. When we do, we will revise the "Last updated" date above. If we make a material change – particularly any change to our commitments in Sections 2, 5, 6, or 7 – we will notify affected clients directly by email before the change takes effect, and we will not apply a materially less protective policy retroactively to information already collected without your consent. We will maintain prior versions of this policy available on request.

20. Contact us

Use our contact form for general inquiries. For privacy requests, use the contact form with the subject line "Privacy Request."