Privacy policy.

The short version. If you email us, we keep your email and what you wrote so we can reply. If we assess your systems, we keep the findings for 30 days after you accept the report and then delete them. We do not sell anything to anyone, ever. Ask us to delete your data and we will.

1. Who we are

RedForge provides security and data-protection assessments. For data you give us directly, RedForge is the Data Fiduciary. When we assess a client’s systems under a signed agreement, RedForge acts as a Data Processor on that client’s behalf, and the client remains the Data Fiduciary for their own users’ data.

Contact: contact@redforge.in

2. What we collect

3. Personal data encountered during an assessment

An assessment may reveal personal data belonging to your users — that is often the point. We handle it under strict limits:

• We record the type of data, a count, a masked sample and where it was found.
• We do not store raw values in reports, logs or notes.
• We extract the minimum needed to evidence a finding, and nothing beyond it.
• Evidence is stored encrypted and deleted within 30 days of report acceptance unless you ask us in writing to retain it.

4. What we never do

• Sell, rent or trade personal data. There is no circumstance in which this happens.
• Use your data to train an AI model.
• Disclose your findings to anyone, including in marketing, without your written permission.
• Test any system without written authorisation from someone empowered to grant it.

5. Who else sees your data

We keep the list short and will tell you who is on it at any time:

• Email provider — to send and receive mail.
• Website host — serves this site and may log IP addresses for security and abuse prevention.
• Advertising platforms, if you arrived from an advertisement — they may set cookies subject to your consent. You can decline without losing access to anything here.

Some of these operate outside India. Transfers are permitted under §16 of the DPDP Act except to countries the Central Government restricts, and we do not transfer data to any restricted country.

6. How long we keep things

• Enquiries that do not become engagements — 12 months.
• Assessment evidence — 30 days after report acceptance.
• Reports and contracts — 7 years, as records of a professional engagement.
• Analytics — 14 months.

7. Your rights

Under the Digital Personal Data Protection Act, 2023 you may:

• Access a summary of the personal data we hold about you and who we shared it with (§11).
• Correct, complete, update or erase it (§12).
• Raise a grievance with us, and escalate to the Data Protection Board of India if unsatisfied (§13).
• Nominate someone to exercise these rights on your behalf (§14).
• Withdraw consent at any time, as easily as you gave it.

Email contact@redforge.in with “DPDP request” in the subject. We respond within 30 days and usually much sooner.

8. Grievance officer

Grievances go to the same address, marked “Grievance”. We acknowledge within 72 hours and resolve within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.

9. Security of your data

Assessment data is encrypted at rest and in transit, access is limited to personnel working on your engagement, and credentials are never stored in version control or in any shared document. We would be poor advertisements for our own service otherwise.

10. Children

Our services are sold to businesses and are not directed at anyone under 18, and we do not knowingly collect children’s personal data. If you have a question or a concern about this, contact us at contact@redforge.in.

11. Changes

If we change this policy materially we will update the date above and, where we hold your contact details for an active engagement, tell you directly.