Privacy Policy
Tabor Security, Inc.
Effective Date: April 24, 2026 | Last Updated: April 24, 2026
1. Introduction
Tabor Security, Inc. ("Tabor," "we," "us," or "our") provides passive operational technology (OT) network monitoring services to operators of critical infrastructure. This Privacy Policy explains how we collect, use, disclose, and protect personal information in connection with our website (taborsecurity.com and related subdomains) (the "Site") and our OT sensor platform and related software, dashboards, and services (collectively, the "Service").
This Policy applies to personal information we process as a controller. When we process customer data (including any personal information contained in customer OT network telemetry) on behalf of a customer as part of delivering the Service, we act as a processor or service provider and that processing is governed by the applicable Master Subscription Agreement and Data Processing Addendum ("DPA") between us and that customer. Where this Policy and a DPA conflict with respect to customer data, the DPA controls.
2. Scope and Roles
Controller data. Tabor acts as a controller with respect to: Site visitor information; information submitted through contact, demo, and support forms; marketing and event registration data; investor and prospective investor information; job applicant information; and account administration data for customer personnel with logins to our platform.
Processor / service provider data. Tabor acts as a processor (GDPR / UK GDPR), service provider (CCPA/CPRA), and equivalent under other regimes with respect to OT network telemetry, alerts, logs, and metadata that our sensors observe on customer networks and transmit to the Service. We do not use that data except to provide, secure, and improve the Service as instructed by the customer and as permitted under this Policy and the applicable DPA.
3. Information We Collect
3.1 Information you provide to us
- Contact and demo requests: name, business email, phone number, company, title, country, and the contents of your message.
- Account information: username, hashed credentials, role, multi-factor authentication identifiers, and session metadata for authorized users of our platform.
- Support and correspondence: records of communications with our sales, support, and legal teams.
- Investor information: information provided by prospective and actual investors or their representatives, including name, firm, contact information, accreditation status, and subscription documents.
- Job applicants: resume, work history, references, and other information you provide during recruiting.
- Events: registration details for conferences, webinars, and other events we host or co-host.
3.2 Information collected automatically from the Site
- Device and log data: IP address, browser type and version, operating system, referring/exit pages, timestamps, and pages viewed.
- Cookies and similar technologies: we use strictly necessary cookies to operate the Site and, where permitted and where you consent in jurisdictions that require consent, analytics cookies. See Section 9.
3.3 Information collected through the Service (sensor telemetry)
Our sensors are designed to run passively on customer OT networks. They observe network traffic using industry-standard passive protocol analyzers and generate alerts, flow records, asset inventories, and protocol metadata. This telemetry is processed on behalf of the customer and may include:
- Network metadata: source and destination IP addresses, MAC addresses, ports, protocols, packet counts, byte counts, timestamps, session duration, and protocol-specific fields.
- Asset and device information: vendor, model, firmware version, and role of devices observed on the customer network.
- Security events: rule matches, anomalies, and alerts.
- Occasional personal information: in limited cases, network metadata may relate to an identifiable individual (for example, a workstation associated with a named user). Tabor does not attempt to identify individuals from OT telemetry and treats any such information strictly as customer data.
Except where a customer explicitly enables a full packet capture feature, Tabor does not capture or store the content of communications (payloads). We do not record audio or video.
3.4 Information from third parties
- Business contact and enrichment providers (for example, data used to qualify leads).
- Channel partners, resellers, and referral sources.
- Public sources, including professional networks and company websites.
- Background check and identity verification providers, where legally required (for example, for certain personnel or investor onboarding).
4. How We Use Information
We use personal information for the following purposes:
- Providing, securing, maintaining, and improving the Site and the Service.
- Creating and administering accounts and authenticating users.
- Responding to inquiries, demo requests, and support tickets.
- Billing, contracting, and other administrative activities.
- Detecting, investigating, and preventing fraud, abuse, and security incidents affecting Tabor or our customers.
- Communicating with you about the Service, updates, and security matters, and, where permitted, marketing.
- Recruiting and evaluating candidates for employment.
- Complying with legal obligations, responding to lawful requests, and enforcing our agreements.
- Analytics regarding the use and performance of the Site and, subject to the controls in Sections 5 and 6, the Service.
5. Artificial Intelligence and Machine Learning
We use machine learning and, in limited cases, generative AI models to help detect threats, reduce false positives, and suggest remediations within the Service.
Customer data and model training. We do not use identifiable customer data to train generally available or third-party foundation models. We may use customer data to train, tune, or evaluate Tabor-operated detection and remediation models that are used to provide the Service, subject to the following safeguards:
- Data is used only for the purposes of providing, securing, and improving the Service.
- Customer data is logically segregated and access-controlled.
- Where a customer's DPA restricts the use of its data for model training or improvement, those restrictions control.
- Customers may opt out of use of their identifiable data for cross-tenant model improvement by contacting privacy@taborsecurity.com; opt-out does not affect models trained on de-identified or aggregated data as described in Section 6.
Third-party AI subprocessors. Where we use third-party model providers to process customer data (for example, to generate natural-language explanations of alerts), we contractually prohibit those providers from using the data to train their own models, we configure zero-retention or short-retention settings where available, and we disclose material subprocessors in our subprocessor list.
6. De-Identified and Aggregated Data
We create de-identified and aggregated data from information collected through the Site and the Service. De-identified data is data that cannot reasonably be used to identify a particular individual, household, device, or customer. Aggregated data is statistical information derived from multiple sources such that individual records cannot be re-identified.
Examples of how we may use de-identified or aggregated data include: producing threat intelligence; benchmarking OT network performance; publishing industry reports; improving our detection content; and, on a commercial basis, sharing or selling de-identified and aggregated insights with third parties such as financial institutions, insurers, researchers, and industry analysts.
Before using data in de-identified or aggregated form, we apply measures designed to ensure that the data cannot reasonably be linked to a specific customer or individual, including removing direct identifiers, generalizing values, and suppressing small-cell results. We commit to maintain such data in de-identified form, not to attempt to re-identify it, and to contractually prohibit recipients from attempting to re-identify it.
7. How We Share Information
We share personal information with the following categories of recipients:
- Subprocessors and service providers: cloud hosting, security tooling, analytics, communications, payment processing, customer support, background checks, and professional services.
- Channel partners and resellers: where a customer purchases the Service through a reseller, we may share account and support information with that reseller.
- Corporate transactions: in connection with a merger, acquisition, financing, or sale of assets, subject to customary protections.
- Legal and safety: to comply with applicable law, lawful requests, court orders, or legal process; to enforce our terms; and to protect our rights, property, or the safety of others.
- Professional advisors: auditors, lawyers, accountants, and insurers.
- With your direction or consent.
No sale or share of personal information for advertising. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are defined under the CCPA or similar U.S. state laws.
8. International Data Transfers
Tabor is headquartered in the United States, and we and our subprocessors may process personal information in the United States and other countries. For transfers from the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses and supplementary measures. For transfers from Canada, we comply with PIPEDA and applicable provincial laws.
9. Cookies and Analytics
We use cookies and similar technologies on the Site. We classify cookies as strictly necessary, functional, analytics, and marketing. Strictly necessary cookies are always set. For other categories, in jurisdictions that require prior consent, we load them only after consent.
We use Google Analytics to measure Site use. We honor Global Privacy Control ("GPC") signals for California and other U.S. jurisdictions that recognize GPC.
10. Retention
| Data Category | Typical Retention | Basis |
|---|---|---|
| Site contact / demo submissions | 24 months from last contact | Legitimate interest, contract |
| Account and authentication data | Duration of account + 90 days | Contract |
| Billing and tax records | 7 years | Legal obligation |
| OT sensor telemetry (customer data) | Per customer DPA (default 12 months rolling) | Contract, processor role |
| Security logs | 12 months | Legitimate interest, legal obligation |
| Job applicant records | 24 months from application | Legitimate interest, legal obligation |
| Investor records | Duration of relationship + 7 years | Legal obligation |
| De-identified and aggregated data | Indefinitely | Not personal information |
11. Security
We maintain an information security program designed to ISO/IEC 27001 and SOC 2 principles. Safeguards include encryption in transit and at rest, multi-factor authentication, least-privilege access controls, network segmentation, logging and monitoring, vendor risk management, vulnerability management, and incident response. No system is perfectly secure; we cannot guarantee that unauthorized third parties will never defeat our safeguards.
12. Your Rights
Depending on where you reside, you may have rights including: access, correction, deletion, portability, objection, opt-out of sale/sharing/profiling, withdrawal of consent, and the right to lodge a complaint with a supervisory authority.
To exercise these rights, contact us at privacy@taborsecurity.com. We will verify your request and respond within the time frame required by applicable law. We will not discriminate against you for exercising your rights.
Customer personnel and end users. If your personal information is processed by Tabor as a processor on behalf of a customer, please direct rights requests to that customer.
13. Regional Disclosures
California and other U.S. states. In the preceding 12 months, we have collected the following categories of personal information (as defined under CCPA): identifiers; customer records information; commercial information; internet or other electronic network activity information; professional or employment-related information; and inferences. We do not sell or share personal information for cross-context behavioral advertising.
EEA, UK, and Switzerland. Controller: Tabor Security, Inc., 1515 N Federal Highway, Suite 300, Boca Raton, FL 33432, USA. Legal bases include performance of a contract, legitimate interests, compliance with legal obligations, and consent.
Canada. We comply with PIPEDA and applicable provincial laws. Our accountability officer is reachable at privacy@taborsecurity.com.
14. Children
The Site and the Service are not directed to children, and we do not knowingly collect personal information from children under 16.
15. Third-Party Links
The Site and the Service may link to third-party websites and services. This Policy does not apply to those third parties.
16. Changes to this Policy
We may update this Policy from time to time. When we make material changes, we will update the "Last Updated" date and, where required by law, provide additional notice.