What this site collects about you

Visiting this site

Server logs

The site is served by Amazon CloudFront, which writes one line per request. That line contains:

• The IP address the request came from, plus the X-Forwarded-For header if a proxy set one.
• The network operator (ASN) and the country the address resolves to.
• The browser User-Agent string.
• The referring URL, if your browser sent one.
• The path and query string requested, and the HTTP status returned.
• Timing, byte counts, TLS version and cipher, and which edge location served it.

This site sets no cookies and loads no third-party scripts. The log configuration also drops the Cookie header rather than recording it.

We use these logs to see which pages get read, to tell real readers apart from the large volume of automated traffic that hits any public site, and to diagnose errors. We do not build a profile from them, and we do not sell, rent, or share them for advertising.

Raw logs are deleted after 400 days, which is roughly thirteen months, enough to compare a month against the same month a year earlier. The limit is enforced by a lifecycle rule on the storage itself, not by anyone remembering to clean up.

If you are in the UK or the EU: the lawful basis for this is our legitimate interest in operating, measuring, and securing the site. An IP address is personal data, which is why the retention limit exists.

Booking a call

Calendly

Every “Book a call” button points at /go/calendly, a redirect on our own CDN, and from there to Calendly. The redirect exists so a click shows up in the server logs described above without loading a tracking script into your browser. Nothing is set on your device by the button itself.

Once you are on Calendly, you are on their platform. Booking a call means giving them your name, email address, the time you picked, and anything you type into the notes. We receive that booking and use it to hold the meeting and prepare for it. Calendly processes it under their own privacy policy and their own cookies.

Emailing us

Google Workspace

Email to hello@22security.com, or to any other 22security.com address, is delivered to Google Workspace, which stores it for us. We use what you send to reply and to keep track of the conversation.

Client work

Engagements are governed by the contract, not by this page

If you engage 22 Security, the data involved is handled under the signed engagement letter or accepted AWS Marketplace private offer, and any data processing agreement attached to it. That covers assessment findings, evidence collected for an audit, and anything gathered during incident response, along with the confidentiality terms and retention periods that apply to it. Those terms govern. This page does not narrow them and cannot widen them.

Your rights

Asking what we hold, or asking us to delete it

Depending on where you live, you can ask us what personal data we hold about you, ask for a copy, ask us to correct or delete it, or object to how we are using it. We honor these requests wherever they come from rather than checking your jurisdiction first.

Email hello@22security.com and we will respond within 30 days.

One practical note. Server logs are keyed to IP addresses and are not linked to a name, so for those we generally cannot tell which lines are yours unless you tell us the address and roughly when you visited. Emails and bookings are easy to find by email address.

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as California uses those terms.

Who to contact

Who is responsible for this

22 Security LLC is the data controller for everything described on this page. Questions, requests, and complaints all go to hello@22security.com, or by post to:

If we change how any of this works, we will update the page and move the date at the top. There is no mailing list to notify.