Privacy Policy

SOC Rotate ("SOC Rotate", "we", "us") provides shift-scheduling and rotation software for Security Operations Centers, delivered as a hosted web application.

This policy explains how we handle personal data. For most data processed in the product, our customer (the organisation that subscribes to SOC Rotate) is the data controller and we act as the data processor on their instructions. For our own website, marketing, and account administration, we are the controller.

Questions about this policy or your data can be sent to privacy@socrotate.com.

We collect only what is needed to run the service:

• Account data — name, work email, password (stored only as a salted hash), organisation, and role (Manager, Team Lead, Analyst).
• Operational data you enter — team members, shifts, rotations, leave requests, swap requests, coverage rules, and handover notes.
• Usage and technical data — log data such as IP address, browser type, and timestamps, used for security and to operate the service.
• Communications — messages you send us via contact, demo, or support requests.

We do not intentionally collect special categories of personal data. Please do not enter health, biometric, or other sensitive details into free-text fields such as handover or leave notes.

• To provide, maintain, and secure the scheduling service.
• To authenticate users and enforce role-based access control.
• To send transactional messages such as sign-in links, password resets, and rotation or handover reminders.
• To respond to support, sales, and demo enquiries.
• To detect, prevent, and investigate security incidents and abuse.
• To meet legal and accounting obligations.

We do not sell personal data, and we do not use customer operational data to train machine learning models or for advertising.

Where the GDPR applies, we rely on the following legal bases:

• Performance of a contract — to deliver the service to our customers and their users.
• Legitimate interests — to secure the service, prevent abuse, and operate our business, balanced against your rights.
• Legal obligation — to comply with applicable law.
• Consent — where required, for example certain marketing communications, which you may withdraw at any time.

We use a small set of vetted infrastructure providers to operate SOC Rotate:

• Supabase — managed Postgres database, authentication, and storage.
• Vercel — application hosting and content delivery.
• Resend — transactional email delivery.

Each sub-processor is bound by a data processing agreement. A current list of sub-processors is available on request from privacy@socrotate.com.

We aim to host customer data in the region agreed with the customer. Where personal data is transferred outside the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. Customers with specific data-residency requirements should contact us at privacy@socrotate.com before onboarding.

We retain customer operational data for as long as the customer's account is active. After an account is closed, data is deleted or anonymised within 90 days unless a longer period is required by law. Customers may request export or deletion of their data at any time.

We apply technical and organisational measures appropriate to the risk, including:

• Encryption in transit (TLS) and at rest.
• Row-level data isolation so each organisation can only access its own records.
• Role-based access control and least-privilege internal access.
• Audit logging of sensitive changes.

To report a vulnerability, contact security@socrotate.com.

Depending on your location, you may have rights to access, correct, delete, restrict, or port your personal data, and to object to certain processing. Because much of the data in SOC Rotate is controlled by your employer, please direct requests to your organisation's administrator first; we will support them in fulfilling your request.

You can also contact us directly at privacy@socrotate.com. If you are in the EEA or UK, you have the right to lodge a complaint with your local data protection authority.

We use strictly necessary cookies to keep you signed in and to secure the service. We do not use advertising or cross-site tracking cookies. Aggregate, privacy-preserving analytics may be used to understand product usage.

We may update this policy from time to time. Material changes will be communicated through the product or by email. The "last updated" date above always reflects the current version.

For any privacy question or request, email privacy@socrotate.com. For security matters, email security@socrotate.com.