LEGAL
Privacy Policy
Last updated: 19 October 2026
1. Introduction and Scope
Trixent Security provides offensive security assessments, vulnerability assessments and penetration testing (VAPT) services to businesses and organisations.
This Privacy Policy explains how we collect, use, disclose, store and protect personal information when you visit https://trixentsecurity.com, contact us, submit a service enquiry, request a proposal or communicate with us about our services.
This policy applies to our public website, enquiry forms and associated business communications. It does not replace the contractual arrangements governing client security engagements. Information handled during an authorised assessment is also governed by the applicable engagement agreement, Statement of Work, Rules of Engagement, confidentiality terms and Data Processing Agreement (DPA), where applicable.
Our services are intended primarily for businesses and organisations. We do not knowingly solicit personal information from individuals under 18 through our website. If you believe that someone under 18 has submitted personal information to us, please contact us so that we can assess the situation and take appropriate action.
2. Who We Are and How to Contact Us
The website is operated under the name Trixent Security.
- Website: https://trixentsecurity.com
- General enquiries: contact@trixentsecurity.com
- Privacy and grievance contact: privacy@trixentsecurity.com
- Privacy and Grievance Officer: Ajay Malik, subject to confirmation of formal designation and contact arrangements before this role is published.
The legal operator's identity and applicable business or correspondence address must be confirmed before publication where required by the applicable legal framework.
Privacy requests and grievances should be sent to privacy@trixentsecurity.com with the subject line Privacy Request. General business enquiries should be sent to contact@trixentsecurity.com.
We will maintain an appropriate process for receiving, reviewing and responding to requests, and will handle grievances within the timeframes required by applicable law.
3. Information We Collect
The information collected depends on how you interact with us.
A. Contact and Service Enquiries
When you submit an enquiry or request a proposal, we may collect:
- Your name and business email address.
- Your telephone number, if provided.
- Your organisation and job title, if provided.
- The service you are interested in.
- Your proposed assessment scope, target information, preferred timeframe and other project requirements.
- Any additional information you voluntarily include in your message.
Please do not submit passwords, private keys, API keys, access tokens, production datasets or other confidential technical material through the public enquiry form.
B. Technical and Security Information
When you access the website, the website and its infrastructure may process technical information needed to serve requests and protect the service, including:
- IP address and request timestamp.
- Requested URL, HTTP method and connection information.
- Browser or device information, such as the User-Agent header.
- Error information and security-related request metadata.
- Rate-limiting or abuse-prevention records, where these controls are implemented.
If Cloudflare Turnstile is active on the website, it may also process technical signals used for bot detection, such as the visitor's IP address, TLS fingerprint, User-Agent header, sitekey and associated origin. This description must appear as a definite statement only when Turnstile's production deployment has been verified.
C. Business Correspondence and Records
We may retain communications relating to service enquiries, proposals, quotations, contracts, invoices, payment records, business relationships and other legitimate operational matters.
D. Client Engagement Information
During an authorised security engagement, we may handle scope information, network and application details, architecture diagrams, test credentials, vulnerability findings, screenshots, proof-of-concept material, assessment reports and related correspondence.
Such information is handled under the applicable engagement arrangements and is subject to the relevant confidentiality, security and retention requirements.
4. How We Use Information
We use information for purposes including:
- Responding to enquiries and requests for proposals.
- Understanding requested services and preparing appropriate scope recommendations.
- Communicating with prospective and existing clients.
- Delivering and administering agreed services.
- Operating, maintaining and protecting the website.
- Preventing spam, automated abuse, unauthorised access and other security issues.
- Maintaining relevant business, contractual and financial records.
- Investigating security incidents and addressing technical problems.
- Responding to privacy requests, legal obligations and legitimate claims.
We do not sell personal information to data brokers or sell enquiry information for advertising purposes. We do not use business enquiry details for unsolicited promotional marketing campaigns.
5. Legal Framework and Grounds for Processing
We handle personal information in accordance with the laws applicable to the relevant processing activity, including applicable provisions of India's Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
The Digital Personal Data Protection Act, 2023 and associated rules have a phased commencement schedule. We will update our practices and this policy as the relevant provisions become applicable.
Depending on the circumstances and applicable law, we may process information to:
- Respond to an enquiry or take steps requested before entering into a potential contract.
- Perform a contract or administer an existing business relationship.
- Meet applicable legal or regulatory obligations.
- Protect the website, investigate abuse and maintain security, where the applicable law permits that processing.
- Establish, exercise or defend legal claims.
- Obtain consent where consent is required for a particular activity.
These purposes are not a claim that one legal ground applies to every category of information. The appropriate ground depends on the specific processing activity and the legal framework that applies.
Where processing relies on consent, and the applicable law provides for withdrawal, you may withdraw that consent using the relevant contact channel. Withdrawal does not retrospectively invalidate processing that was lawful before withdrawal, and it does not prevent processing that may continue on another lawful basis.
6. Service Providers and How Information Flows
We use service providers to support the website, business communications and enquiry workflow. Their precise roles depend on the services configured in our live environment.
Website Hosting and Technical Logs
Our production website hosting provider processes the technical information necessary to deliver website requests and may process server, connection and security logs.
The production hosting provider and relevant processing location must be established before we identify a specific provider or location in this policy.
Business Email
Hostinger provides business email services for our domain, subject to confirmation against the live mailbox configuration. Messages delivered to our receiving inboxes may be retained in those mailboxes, archives or backups according to the applicable configuration and provider terms.
Contact Form Email Delivery
We use Resend to transmit contact form submissions through its email API to the configured receiving mailbox.
Resend's published documentation states that customer data is stored in the United States and that email and log data are retained for 30 days on its Free, Pro and Scale plans. This provider-side retention is separate from retention within our receiving mailbox or other systems. We will review the applicable service terms if our plan or configuration changes.
See Resend Security and Resend GDPR and data processing information.
Anti-Bot and Security Services
If Cloudflare Turnstile is enabled on our live contact form, it is used to assess whether form submissions are likely to be automated abuse. Relevant technical signals are processed for this security purpose.
Other Disclosures
We may disclose information to professional advisers or authorities where necessary for the relevant service, to satisfy an applicable legal obligation, to respond to a valid legal request, or to establish, exercise or defend legal claims.
We do not intentionally provide enquiry information to unrelated third parties for their own advertising purposes.
7. International Processing and Transfers
Some service providers may process information outside India. Resend's published documentation identifies the United States as the location where it stores customer data.
The processing locations of other providers depend on the services and configurations used. We do not claim that all website, email, security-log or client-engagement information is stored exclusively in India.
Where applicable law imposes requirements on international transfers, we will apply the requirements relevant to the processing activity.
8. Data Retention
We retain information only for as long as reasonably necessary for the relevant purpose, subject to applicable contractual and legal requirements.
Website Enquiries
We generally retain enquiry correspondence for up to 12 months after the last substantive communication when the enquiry does not become an engagement, unless a longer period is justified by an ongoing business matter, contractual requirement or legal obligation.
Email Delivery Provider
Resend retains email and log data for 30 days on its Free, Pro and Scale plans, according to its published documentation. Copies in our receiving mailbox, archives or other systems have separate retention arrangements.
Website and Security Logs
Technical and security logs may be retained for operational troubleshooting, abuse prevention, security investigations and legal compliance.
Where CERT-In Directions apply to our systems, the applicable log-retention and storage-location requirements must be met. The actual retention and location of provider-managed logs must be verified against our live hosting and logging configuration before we make a more specific public statement.
Business and Contractual Records
Proposals, contracts, invoices, payment records and related correspondence may be retained for the periods needed to administer the business relationship, meet applicable statutory obligations and resolve disputes.
Client Engagement Data
Retention of assessment reports, raw testing artefacts, temporary credentials and related evidence is governed by the applicable engagement agreement, Rules of Engagement, DPA where applicable, and any relevant legal obligations.
Backups and Deletion
Information deleted from active systems may remain temporarily in provider-managed backups or archives under the relevant backup lifecycle. The retention and deletion behaviour of each provider must be considered separately. Where information is restored from a backup, applicable deletion requirements will be reassessed.
We do not publish a universal backup-expiry period until the actual backup configuration and provider commitments have been confirmed.
9. Information Security
We use appropriate technical and organisational safeguards intended to protect information against unauthorised access, loss, alteration and disclosure.
Depending on the system and information involved, these safeguards may include:
- HTTPS/TLS for website connections.
- Access restrictions and appropriate authentication.
- Input validation and measures against abusive submissions.
- Security monitoring and relevant log records.
- Data minimisation and controlled handling of confidential information.
- Appropriate safeguards provided by the infrastructure and communication services we use.
The specific controls applied depend on the system and service involved. We do not claim that any transmission or storage system is entirely risk-free, and we cannot guarantee absolute security.
Client assessment evidence is handled under the applicable engagement procedures rather than treated as ordinary public website enquiry information.
10. Cookies and Browser Storage
We limit browser storage and tracking technologies strictly to what is necessary for website operation, security, and agreed site improvements. We do not use third-party advertising cookies, marketing tracking pixels, or cross-site behavioural tracking.
Technologies Used on This Website
- trixent_consent (First-Party Cookie): Stores your cookie consent preferences across sessions so that we respect your choices. Retention is 180 days. This cookie is Strictly Necessary to satisfy legal consent management requirements. It contains a compact, versioned JSON record and contains no personal identifiers or tracking codes.
- trixent-theme (Browser Local Storage): Remembers your selected visual presentation theme (such as high-contrast or alternative styling) between visits. This is a functional preference stored locally on your device and is not transmitted to our servers or third parties.
- Cloudflare Turnstile (Security and Anti-Abuse Tokens): Deployed on public enquiry and sample-report request forms to verify that submissions originate from human visitors rather than automated bots. This is Strictly Necessary for infrastructure security and abuse prevention.
- Performance and Analytics (Optional): Aggregated, privacy-respecting technical measurement used to assess site responsiveness and page performance. Optional performance measurement is activated only when you explicitly grant consent through the cookie banner or preferences modal.
11. Sharing and Disclosure
We share information only where necessary for the purposes described in this policy, under applicable contractual arrangements, or where permitted or required by law.
This may include sharing with:
- Hosting, email and other infrastructure providers used to operate the website.
- Service providers involved in transmitting and processing enquiries.
- Professional advisers assisting with legal, business or compliance matters.
- Authorities or other parties where disclosure is required by law or is otherwise lawfully permitted.
We do not intentionally sell enquiry information or share it with unrelated advertising businesses for their independent promotional purposes.
12. Client Engagement Data and Requests About Client Information
Where we process personal data on a client's behalf, our role and responsibilities depend on the relevant engagement, the parties' actual roles and the applicable agreement.
Where the client determines the purposes and means of processing and Trixent acts as its processor, we process that information in accordance with the client's documented instructions and the applicable DPA or other contractual terms.
Requests concerning personal data held on behalf of a client should ordinarily be directed to the relevant client, where the client is responsible for responding to those requests. If we receive such a request directly, we will handle or forward it as appropriate under the engagement agreement and applicable law.
We apply the same distinction when considering deletion requests, disclosures, retention obligations and other rights relating to client engagement information.
13. Privacy Requests and Grievance Redressal
You may contact us about our handling of personal information, request correction of inaccurate information, raise a grievance or exercise other rights available under the applicable law.
The rights available to you, and the timeframes for responding, depend on the applicable legal framework and the provisions in force at the relevant time.
To submit a request, email:
Use the subject line Privacy Request and include enough information for us to understand the request. We may ask for reasonable information to verify your identity and protect personal information from unauthorised disclosure.
We will assess requests in light of applicable law, contractual responsibilities and any lawful requirement to retain information.
Where the SPDI Rules apply, grievances will be addressed within the applicable timeframe, including the one-month requirement under Rule 5(9).
Where information is processed on behalf of a client, we may need to refer the request to that client in accordance with the relevant agreement and applicable law.
14. Third-Party Websites and Services
Our website may contain links to external websites or services. Those third parties operate under their own privacy practices and terms.
We do not control the content, security or privacy practices of external sites and are not responsible for their independent handling of information. We recommend reviewing the applicable privacy notices before submitting information to third parties.
15. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in our services, data flows, service providers, technical practices or legal requirements.
We will publish the revised policy on this page and update the version information and date to reflect the published revision.
We will review this policy periodically and when a material change to our processing activities or applicable legal requirements makes a review necessary.
16. Related Documents
The following documents provide additional information about our practices and services:
- Terms of Use: Governs use of our website, subject to its stated scope.
- Security Policy: Explains how confidential information is handled during authorised client security engagements.
- Data Processing Agreement: Where applicable, sets out contractual terms for processing personal data on behalf of a client.
The relevant document links will be provided through the website when the applicable document is available and approved for publication. A DPA may also be provided as part of the relevant client engagement.
17. Contact Information
For general business enquiries:
For privacy requests and grievances:
Privacy contact: privacy@trixentsecurity.com
Grievance Officer: Ajay Malik, once the designation and contact process have been formally confirmed.
The legal operator and applicable business or correspondence address must be confirmed before publication where required by law. Please use the relevant email subject line so that your communication can be directed to the appropriate process.