Privacy Policy

This Policy describes the information Raxis collects from you, or that you provide, when you visit raxis.com or use the Raxis One customer portal (together, the “Sites”), and how we collect, use, protect and disclose that information.

This Policy applies to information Raxis collects:

• On the Sites.
• In email, text and other electronic messages between you and Raxis.
• Through requests from the Raxis sales or operations team while scoping or delivering an engagement.

It does not apply to information collected by any third party, including through any website, application or content that links to or from the Sites.

Please read this Policy carefully. If you do not agree with our practices, your choice is not to use the Sites. By using the Sites you accept this Policy. We may change it from time to time (see Changes to This Policy). Your continued use of the Sites after a change means you accept the change, so please check back periodically.

Raxis provides manual penetration testing and related security services. These include network, web application, API, cloud, red team, physical, IoT and OT, and AI and LLM penetration testing, delivered as point-in-time assessments (Raxis Strike) or as continuous testing (Raxis Attack) and managed through the Raxis One portal. This work involves access to customer systems, networks and data, and Raxis treats the confidentiality and security of that information as part of every engagement.

• Raxis keeps customer data private. Information we access, collect or generate during an engagement is used only to deliver the contracted services. It is not sold, shared or disclosed for any other purpose.
• Raxis involves third parties in an engagement only when they have signed a nondisclosure agreement for the work and are bound by confidentiality and privacy obligations consistent with this Policy.
• Raxis uses AI tools only where the provider commits not to train its models on customer data and to keep that data private. We do not submit customer data to AI tools that reserve the right to use it for training.
• Raxis performs active testing from devices with encrypted storage, so customer data on testing systems is protected.
• Raxis retains only redacted findings and the supporting data needed for reporting. Critical data, whether identified during our analysis or defined during scoping, is not removed from the customer environment and is not retained by Raxis.

The specific terms of each engagement, including data handling, retention and return, are governed by the services agreement and statement of work between you and Raxis. For more on our security controls, certifications and data handling, visit the Raxis Trust Center.

The Sites are not intended for children under 16, and Raxis does not knowingly collect Personal Information from them. If you are under 16, do not use the Sites or provide any information to us. If we learn that we have collected Personal Information from a child under 16 without verified parental consent, we will delete it. If you believe we might have information from or about a child under 16, contact us at infosec@raxis.com.

California residents under 16 may have additional rights regarding the collection and sale of their Personal Information. See Your California Privacy Rights.

Raxis collects several types of information from and about users of the Sites:

• Information that identifies you, such as your name, company, postal address, email address, telephone number and any other identifier by which you may be contacted online or offline (“Personal Information”).
• Information about you that does not identify you on its own, such as your IP address and browser user agent.
• Information about your internet connection, the device you use to reach the Sites, and how you use them.

We collect this information:

• Directly from you when you provide it, for example by filling in a form.
• Automatically as you browse the Sites, through server logs and the cookies described below.
• From third parties, for example our business partners.

• Information you enter in forms on the Sites, such as requesting a quote, a sample report or our newsletter, applying to partner with us, applying for a job, or reporting a problem.
• Records and copies of your correspondence, including your email address, if you contact us.
• Your responses to surveys we might ask you to complete.
• Information you provide when registering for or using an account on the Raxis One portal.
• Your search queries on the Sites.

As you use the Sites, we may automatically collect details of your visits, including the pages you view, the time you spend, the site that referred you, your IP address, operating system and browser type. This helps us understand how the Sites are used, estimate our audience, and improve the content and the experience. We may associate this information with Personal Information you provide, for example when you fill in a form after browsing.

A cookie is a small file that a website stores in your browser. Raxis uses cookies in three categories. When you first visit raxis.com, a banner asks which categories you allow, and you can change your choice at any time from the Cookie Settings link in the footer of every page. What runs before you choose depends on where you are visiting from. In the European Economic Area, the United Kingdom and Switzerland, nothing beyond the necessary cookies is set until you choose. Elsewhere, analytics and marketing cookies are on by default and you can turn either off in the banner.

Necessary. Required for the Sites to work. This includes the cookie that stores your cookie choices (raxis_consent, kept for one year), the cookies that keep you signed in to the Raxis One portal, and any cookie needed by Cloudflare, which hosts the Sites and screens form submissions for automated abuse. These cannot be turned off.

Analytics. Google Analytics, loaded through Google Tag Manager, to measure traffic and understand which pages are useful. Where analytics cookies are off, whether by region or by your choice, Google still receives anonymous, cookieless signals that let it estimate overall traffic, but it sets no cookie and does not recognize you across visits or pages. Google’s use of this data is described in the Google Privacy Policy.

Marketing. Three services, which load only where marketing cookies are allowed, by default outside the regions above or by your choice in the banner:

• HubSpot, the customer relationship platform our sales team uses. It sets a cookie that lets us connect the pages you visited with your contact record if you later contact us, so our team understands what you were looking for. See the HubSpot Privacy Policy.
• ZoomInfo WebSights, which uses your network address to identify the company you are visiting from, so we know which organizations are researching our services. It does not identify you personally. See the ZoomInfo Privacy Policy.
• Microsoft Advertising, which sets a cookie so that we can tell when a visit came from one of our ads on Bing and measure whether those ads lead to enquiries. Where Microsoft Clarity is enabled on the same tag, it also records how pages are used. See the Microsoft Privacy Statement.

Google, HubSpot, ZoomInfo and Microsoft are the only third parties that set cookies through the Sites. If that changes, we will update this Policy and the categories in the banner.

You can also set your browser to refuse all or some cookies, or to alert you when a cookie is set. If you refuse necessary cookies, some parts of the Sites, such as the Raxis One portal, may not work.

Raxis uses the information we collect about you, or that you provide, including Personal Information:

• To present the Sites and their content to you.
• To provide the information, products or services you request from us.
• To fulfill any other purpose for which you provide it.
• To send you notices about your account or engagement.
• To carry out our obligations and enforce our rights under any contract between you and us, including billing and collection.
• To notify you about changes to the Sites or to any products or services we offer.
• In any other way we describe when you provide the information.
• For any other purpose with your consent.

We may also use your information to contact you about services that may interest you. If you do not want us to do so, email infosec@raxis.com. See Your Choices.

Raxis may disclose aggregated information about our users, and information that does not identify any individual, without restriction.

We may disclose Personal Information that we collect or that you provide:

• To our subsidiaries and affiliates.
• To contractors, service providers and other third parties we use to support our business, who are bound by contract to keep Personal Information confidential and to use it only for the purposes we disclose it to them.
• To a buyer or other successor in a merger, divestiture, restructuring, reorganization, dissolution or other sale or transfer of some or all of Raxis’ assets, in which Personal Information about users of the Sites is among the assets transferred.
• To fulfill the purpose for which you provide it.
• For any other purpose we disclose when you provide the information.
• With your consent.

We may also disclose your Personal Information:

• To comply with any court order, law or legal process, including a government or regulatory request.
• To enforce or apply our Terms and Conditions and other agreements, including for billing and collection.
• If we believe disclosure is necessary to protect the rights, property or safety of Raxis, our customers or others. This includes exchanging information with other companies and organizations for fraud protection.

Raxis does not sell your Personal Information.

Cookies. Use the Cookie Settings link in the footer to change which cookies you allow, or set your browser to refuse cookies as described in Cookies.

Marketing email. If you do not want Raxis to use your contact information to promote our services, email infosec@raxis.com. Every marketing email we send also includes an unsubscribe link. This does not apply to messages about an engagement or account you have with us.

California residents may have additional rights and choices. See Your California Privacy Rights.

Nevada residents who wish to exercise their sale opt-out rights under Nevada Revised Statutes Chapter 603A may contact infosec@raxis.com. Raxis does not currently sell data covered by that statute.

Raxis One users can review and change their Personal Information in their account profile.

Anyone may email infosec@raxis.com to request access to, correction of, or deletion of Personal Information they have provided to us. We may not be able to delete your Personal Information without also closing your account, and we may decline a change if we believe it would violate a law or legal requirement or make the information incorrect.

If you are a California resident, California law may provide you with additional rights regarding our use of your Personal Information. To learn more, visit oag.ca.gov/privacy/ccpa.

California’s “Shine the Light” law (Civil Code Section 1798.83) permits California residents who use the Sites to request certain information about our disclosure of Personal Information to third parties for their direct marketing purposes. To make such a request, email infosec@raxis.com or write to us at the address below.

Raxis has implemented measures designed to protect your Personal Information from accidental loss and from unauthorized access, use, alteration and disclosure. The Sites are served over encrypted connections, and information you provide is stored on access-controlled systems.

The security of your information also depends on you. Where we have given you, or you have chosen, a password for the Raxis One portal, you are responsible for keeping it confidential. Please do not share it with anyone.

No transmission over the internet is completely secure. Although we do our best to protect your Personal Information, we cannot guarantee the security of information sent to the Sites, and any transmission is at your own risk.

We post any changes to this Policy on this page and update the “Last updated” date at the top. If we make material changes to how we treat Personal Information, we will notify Raxis One users by email at the address on their account, or through a notice on the home page. You are responsible for keeping an up-to-date email address on your account and for checking this Policy periodically.

To ask questions or comment about this Policy and our privacy practices, contact Raxis at infosec@raxis.com or:

You can also reach us through the contact form on this site.