L1. Scope & Relationship
This supplement applies to the Emberix platform (the "Service"), including customer workspaces, Service APIs, and customer-deployed Emberix Agents. It supplements the Emberix Privacy Policy. That policy applies to matters not addressed here; this supplement controls where it is more specific.
L2. Roles
Emberix LLC, 1000 Bourbon Street #290, New Orleans, LA 70116, is the controller of information used for Emberix account administration, billing, security, support, and Emberix business operations. For assessment data submitted by a Customer or collected through an authorized Customer deployment, the Customer generally acts as controller or business and Emberix acts as processor or service provider under the applicable agreement.
Customers and MSPs are responsible for establishing a lawful basis and obtaining any authorization required to assess systems, networks, domains, and assets submitted to the Service.
L3. Service Data
- Account and access data: name, work email, company, role, memberships, invitations, delegated-access grants, authentication identifiers, and login activity.
- Commercial data: billing contacts, subscription, plan, invoice, tax, transaction, and payment-method metadata processed with Stripe. Emberix does not store full payment-card numbers.
- Assessment and Customer Data: authorized targets and related public-facing assets the Service discovers; inventory and topology; hostnames; IP and MAC addresses; device, port, service, DNS, certificate, API, finding, evidence, scan, report, and sanitized configuration data.
- Connected-directory data: when a Customer connects Microsoft 365 or Google Workspace, the third-party applications authorized in that directory, their granted permissions, pseudonymous identifiers for the accounts that granted them, and identity security setting results, as described in L5.
- Agent data: Agent identifiers, claim and check-in activity, diagnostic data, and hashed Agent credentials.
- Operational and audit data: request identifiers, source IP, timestamps, actions, affected resources, feature usage, and diagnostic events.
- Communications: invitations, support messages, privacy and security correspondence, and other transactional communications.
L4. How the Service Uses Data
- Provide network, topology, vulnerability, API-exposure, and public attack-surface assessment features.
- Authenticate users and Agents; administer workspaces, roles, delegated access, subscriptions, and entitlements.
- Generate findings, evidence, reports, exports, and security audit history.
- Process billing and send invitations, password-setup messages, grant-expiry notices, and other service communications.
- Operate, troubleshoot, secure, and prevent misuse of the Service.
- Comply with law and improve the Service using aggregated or de-identified information.
L5. Assessment Data Flows
The Service may contact Customer-designated targets and related public-facing assets discovered during an authorized assessment. It may query public certificate, DNS, service-exposure, breach, email-posture, and vulnerability-intelligence sources using a domain, hostname, public IP address, service, or vulnerability identifier. Those services can receive the query, the requesting Emberix system's IP address, and ordinary request metadata.
The current sources are listed separately on our Service Providers & External Data Sources page. Customers should not submit targets they are not authorized to assess or upload raw credentials, payment-card data, or unnecessary secrets.
Identity SaaS discovery (Microsoft 365 and Google Workspace)
A Customer administrator may connect the Customer's Microsoft 365 (Microsoft Entra ID) or Google Workspace directory so the Service can show which third-party applications people in that directory have authorized. Connecting requires an administrator of that directory to grant the Service read-only access: tenant-wide admin consent to the Emberix application in Microsoft Entra ID, or domain-wide delegation to the Emberix service account in Google Workspace. The Service requests no permission to change anything in the directory.
What the Service reads. Through Microsoft Graph or the Google Admin SDK, the Service reads the directory's third-party application registrations and OAuth permission grants: which applications hold which permissions, and which accounts granted them. For Google Workspace it also lists the directory's active user identifiers in order to read each user's third-party application tokens. For Microsoft 365, the Service also reads identity security settings (Conditional Access policies, security defaults, whether users may consent to applications, and the number of privileged role holders) to produce security baseline findings.
What the Service keeps. For each discovered application: its name, publisher, provider application identifier, and granted permissions. For each account that granted an application, the Service keeps only a one-way pseudonymous identifier derived from the provider's account identifier and the Customer's workspace, so the same person cannot be matched across Emberix workspaces. The Service does not store the names or email addresses of the people who granted access. Security baseline results are kept as pass, warn, and fail findings with counts and on/off settings, not the policies themselves or any user identities. Access tokens for the directory are held in memory only and are never stored.
Disconnecting and revoking. Disconnecting a connector in the Service stops further reads, deletes its security baseline results, and marks its application inventory inactive; that inventory and its grant records are then deleted when the workspace's evidence-retention period ends. Disconnecting in the Service does not remove the access granted in the Customer's own directory. To revoke it completely, a directory administrator deletes the Emberix enterprise application (currently listed as "lens-saas-discovery-prod") in Microsoft Entra ID, or removes the Emberix service account's client ID from domain-wide delegation in the Google Workspace Admin console. A disconnected connector in the Service links to the page where this is done.
L6. Hosting & Data Location
The Service's primary application and database workloads are hosted in Microsoft Azure's Central US region. The Service web traffic is processed through Cloudflare's global network, and assessment evidence is stored in Cloudflare R2. Stripe, Microsoft, Google, and technical-intelligence providers may process limited information through their own regional or global infrastructure.
The Service is offered commercially on a United States-focused basis at this stage, but Emberix does not represent that every network request or service-provider operation remains exclusively within one U.S. region.
L7. Providers
The Service uses Microsoft Azure for application, database, queue, backup, and secrets infrastructure; Cloudflare for DNS, security, web delivery, and evidence storage; Stripe for billing and payments; Microsoft 365 and Graph for transactional email and support correspondence; Microsoft Entra or Google Workspace when a Customer chooses federated sign-in; and Microsoft Graph or the Google Admin SDK when a Customer connects Identity SaaS discovery (L5).
See the current provider list for purposes and data categories.
L8. Retention & Deletion
The Service retains Customer Data according to the applicable plan and customer agreement and for as long as reasonably needed to provide and secure the Service. Billing and business records may be retained longer to satisfy legal, tax, accounting, dispute, and enforcement obligations. Security records may also be retained for investigation and integrity purposes. Data from a connected Microsoft 365 or Google Workspace directory is kept while the connector is connected and handled at disconnect as described in L5.
Following termination or a verified deletion request, Emberix applies its then-current offboarding and deletion process, subject to the customer agreement, available export periods, backup rotation, and documented legal or security holds. Backup copies are allowed to expire through ordinary rotation rather than being altered individually.
L9. Security
The Service uses encryption in transit and provider-managed encryption at rest, Azure Key Vault for application secrets, tenant-scoped application authorization, hashed Agent credentials, and durable records of security-sensitive account and administrative actions. No safeguard can guarantee absolute security.
Report a suspected the Service vulnerability or security incident to [email protected].
L10. Access, Export & Contact
Authorized users may export reports, topology, findings, audit information, and other data where the applicable the Service feature and plan make an export available. Requests concerning personal information or a broader Customer Data export or deletion should be sent to [email protected]. We may verify the requester's identity, role, and authority with the relevant Customer.