Privacy policy
What we collect, and what we do with it
We are a security consultancy. The information you give us to buy an assessment, and the information we see while performing one, is handled the way we'd want our own handled. The short version: we collect only what the work needs, we never sell it or share it for marketing, and you can ask us to delete it.
Who we are
Hardpoint Compliance LLC is a Georgia limited liability company based in Atlanta. Questions about this policy go to preston@hardpointcompliance.com.
What we collect
When you visit this website
The site is hosted by Cloudflare. Cloudflare records the technical details of each request (IP address, browser type, pages requested) in its logs to serve the site and protect it from abuse. We do not set tracking cookies. If we use Cloudflare Web Analytics, it counts visits without cookies and without identifying individual visitors.
When you submit the “Start an assessment” form
The form asks for your company name, your name, a work email address, the approximate number of Microsoft 365 users, what is prompting the request, which package you are interested in, whether you would like a call, an optional phone number, and anything else you choose to tell us. Our confirmation email may ask a few follow-up questions (your Microsoft 365 plan, who manages it, who would grant access, how many tenants) so the engagement letter is accurate. We do not ask for, and you should never send, passwords, account credentials, or details of security weaknesses.
When you request the sample report or the self-check guide
The sample report form asks for your name, work email and company. The optional guide request on the 60-second check asks for your name and work email, and sends your five answers with it so the guide can address your gaps. The check itself runs in your browser; nothing is sent to us until you submit that request. We use these details to send what you asked for and to decide whether to follow up once by email. There is no automated email sequence.
The form is protected by Cloudflare Turnstile, which checks that a submission comes from a person rather than a bot. Turnstile may process your IP address and browser characteristics for that purpose and may set a strictly necessary cookie. See Cloudflare's privacy policy.
When you email us
Email to and from Hardpoint Compliance is handled in our Microsoft 365 tenant. We keep correspondence as a business record.
During an engagement
An assessment reads the configuration of your Microsoft 365 tenant through a read-only account you create for us. That includes settings, policies, user and license lists, and audit configuration. It does not include the contents of mailboxes, files, chats, or messages. What we collect, how we protect it, and how long we keep it are set out in your engagement letter, which governs if it differs from this policy.
How we use it
- To reply to you, send an engagement letter, and schedule the work.
- To perform the assessment or hardening you engaged us for and to deliver the report.
- To keep the business records that tax, insurance, and professional obligations require.
- To protect the website and our systems from abuse.
We do not sell personal information. We do not share it with anyone for their marketing. We do not use it to train artificial intelligence models, and we do not allow our service providers to.
Who else processes it
Two companies process data on our behalf, under their standard business terms:
- Cloudflare, Inc. hosts the website, runs Turnstile, and stores form submissions in encrypted storage in the United States until we have copied them into our records.
- Microsoft Corporation provides the Microsoft 365 tenant where our email, documents, assessment working files, and client records live, in United States data centers.
We may also disclose information when the law requires it, to our insurer or attorney in connection with a claim, or to a buyer if the business is ever sold, in which case this policy continues to apply.
How long we keep it
- Form submissions and inquiries that do not become engagements: up to 12 months, then deleted.
- Engagement records, including reports and change logs: for the term of the engagement and for seven years afterward, to meet tax, insurance, and professional record-keeping obligations, unless your engagement letter says otherwise.
- Website logs held by Cloudflare: according to Cloudflare's own retention schedule.
How we protect it
Our own systems are held to the same baselines we assess clients against: multifactor authentication on every account, encryption in transit and at rest, least-privilege access, and audit logging. Assessment access to your tenant is read-only and is removed when the engagement ends. No method of storage is perfectly secure, and we will tell you promptly if we learn that your information was exposed.
Your choices
You can ask us at any time what information we hold about you or your company, ask us to correct it, or ask us to delete it. Email preston@hardpointcompliance.com. We will answer within ten business days. We may need to keep records that a legal, tax, or insurance obligation requires us to keep, and we will tell you if so. We do not respond differently to people who exercise these rights.
This website does not track visitors across other sites and does not respond to browser “Do Not Track” signals because there is nothing to turn off.
Text messages
If you give us your mobile number and agree to receive texts (for example, by checking the optional SMS box on our assessment form or telling us on a call), we use it only to message you about your request or engagement: scheduling, questions, and follow-up. Texts are sent and received through Microsoft Teams. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent are not shared with any third parties. Reply STOP to any text to opt out, or HELP for help. Full details are in our SMS terms.
Children
This website and our services are for businesses. We do not knowingly collect information from anyone under 18.
Changes
If this policy changes, the new version will appear here with a new effective date. Changes that reduce your rights will not apply to information we already hold without telling you first.