Privacy policy

Troglodyte Security, LLC ("TrogSec", "we"). This policy covers the trogsec.com website only. Client engagements are governed by their own agreements.

Draft — pending review by counsel

This policy is a working draft. It describes the site's actual data handling as built, but it has not yet been reviewed by an attorney and should be read in that light. Effective date: to be set on adoption.

1. What this site does not do

  • No analytics, no tracking pixels, no tag managers, no advertising.
  • No third-party scripts, fonts, embeds, or iframes. Every request your browser makes to render this site goes to trogsec.com.
  • No cookies are set by this site.
  • No account, login, or session exists on this site. The "Client Login" link opens a separate service at portal.trogsec.com, described in section 6.

2. Theme preference

If you switch between the dark and light theme, your choice is saved in your browser's local storage under the key trogsec-theme so the site can apply it on your next visit. That value never leaves your browser. Clearing your browser's site data removes it.

3. Information you submit through forms

The site has two forms: the free discovery scan request and the contact form. Submitting either is voluntary. The fields are:

Free scan request
Required: organization name, contact name, work email, approximate user count, number of Microsoft tenants. Optional: phone, whether you run on-premises Active Directory, your compliance driver, and a free-text message.
Contact form
Required: name, work email, message. Optional: organization.

We deliberately do not ask for, and ask you not to send, tenant identifiers, domain names, credentials, or configuration detail through these forms.

4. How form submissions are handled

Form submissions are sent to an endpoint on trogsec.com operated on Cloudflare infrastructure under TrogSec's control. No third-party form service is involved. On receipt, the endpoint:

  1. Accepts the submission only if it was sent from this site's own pages.
  2. Applies a rate limit keyed to your IP address. Your address is turned into a one-way hash under a key that changes daily, and only an hourly count is kept against it. The address itself is never stored, and the counts are deleted after two hours.
  3. Checks every field against a strict list of what each form accepts, removes invisible and control characters, and discards the submission if it fails those checks, if a hidden anti-automation field has been filled in, or if it was sent implausibly soon after the page opened.
  4. Stores the submission in a database under TrogSec's control on Cloudflare before attempting delivery, so a delivery failure does not lose the request. Stored copies are deleted 30 days after delivery, and after 90 days in any case.
  5. Delivers the submission to TrogSec's engagement records system at portal.trogsec.com (ERPNext, hosted by Frappe Cloud) and, by email, to the contact@trogsec.com mailbox (Microsoft 365).

Along with the fields you enter, the endpoint records the time of submission and how long the page was open before the form was sent, which is used to detect automated submissions.

5. How that information is used and kept

Form submissions are used to respond to your request, to qualify and scope a potential engagement, and for no other purpose. They are not sold, shared with advertisers, or used to train any model. Submissions are retained for as long as needed to respond and, if an engagement follows, for the life of that engagement; otherwise they are deleted within a reasonable period. You may ask us to delete your submission at any time using the contact details in section 9.

6. Client Login and portal.trogsec.com

The Client Login button is a link to portal.trogsec.com (formerly erp.trogsec.com), a client portal running ERPNext, hosted by Frappe Cloud on TrogSec's behalf. The portal holds engagement records: contacts, tickets, change requests, invoices. Audit reports and collected tenant data are never stored there; reports are sent by encrypted email (for example Microsoft 365 message encryption) to named client contacts, on request. No part of the sign-in process touches trogsec.com, and this policy does not cover the portal. Portal access is provisioned during onboarding and is governed by the client agreement.

How data collected during an engagement is handled — what is collected, where it is stored, who processes it, how long it is kept — is described on the client data page and made binding by the engagement agreement, not by this policy.

7. Hosting and server logs

trogsec.com is served by Cloudflare. As with any web host, Cloudflare's edge may process connection metadata such as IP addresses and request headers to deliver the site and to protect it from abuse, subject to Cloudflare's own terms. TrogSec does not use that data to identify visitors.

8. Children

This site is directed at organizations and is not intended for children. We do not knowingly collect information from anyone under 18.

9. Your choices and how to reach us

To ask what we hold about you, to correct it, or to have it deleted, email contact@trogsec.com or call (717) 719-9852.

Troglodyte Security, LLC

10. Changes

If this policy changes, the new version is published at this address with an updated effective date. Material changes to how form submissions are handled will be noted here.