FortressSphere Privacy Policy
Last updated: October 2026
1. Who We Are
FortressPoint operates FortressSphere (the "Service"). The Service is a business SaaS platform providing compliance self-assessment, documentation, evidence management, vendor assessment, staff training, AI-assisted compliance functions and related administrative tools.
FortressSphere may be provided by a FortressPoint entity established in the relevant jurisdiction. The applicable contracting entity and its contact details are identified in the order form, subscription agreement or other applicable customer documentation. The UK and Nigerian FortressPoint operations are separate legal entities and should not be treated as interchangeable. Unless an order form or other written agreement names a different entity, the contracting entity is FortressPoint Consulting Limited, a company incorporated in Nigeria.
This Privacy Policy explains how FortressPoint processes personal data for its own purposes in connection with the Service. It also explains the boundary between that processing and personal data that a customer places into or generates through the Service on behalf of other individuals. Where FortressPoint processes customer-controlled personal data as a processor, the customer remains responsible for determining the purposes and means of that processing and the parties' contractual relationship is governed principally by the FortressSphere Data Processing Agreement (the "DPA"), which forms part of the FortressSphere Terms of Service and is available at /dpa.
Data protection contact: compliance@fortresspointconsulting.com
2. What Personal Data We Collect
The Service processes different categories of personal data depending on how it is used. Some information is required to provide particular functions; other information is supplied only when you choose to use a feature.
- Account information: name, email address and authentication information. Email and authentication information are required to create and secure an account. Name is requested for account administration and personalisation.
- Organisation information: company name and, where organisation features are used, information about members and assigned roles such as Admin, Editor and Viewer.
- Audit and compliance information: self-assessment answers, scores, generated compliance documents, Statements of Applicability, implementation-roadmap items, compliance metric snapshots, AI System Register entries and DPIA assessment responses.
- Evidence and uploaded content: documents, files and other material uploaded to the Evidence Vault or used in compliance workflows. Such material may contain personal data, depending on what the customer chooses to upload. Customers must not upload special-category personal data, as set out in the Terms of Service and the DPA.
- Vendor and staff information: vendor contact details, vendor assessment responses, customer staff names, email addresses, departments, training assignments, training status and quiz scores (individual quiz answers are not stored). Where this information relates to individuals who are not FortressPoint's own customers, FortressPoint generally processes it on the customer's behalf as Processor.
- Incident and support information: incident-report content, support tickets, messages, attachments and related communications.
- Enquiry information: details you submit through the Request a Demo and Enterprise contact forms.
- Acceptance records: which version of the Terms and Data Processing Agreement you accepted, and when.
- AI and assistant content: prompts, questions, conversation history, evidence excerpts and other content submitted to AI-assisted functions, to the extent necessary to provide those functions.
- Payment and billing information: payer name, email address, address, transaction status, subscription tier and billing history. Full payment-card details are handled by the payment provider rather than stored directly by FortressPoint.
- Technical and log data: when you use the Service we receive standard web request information, in particular your IP address and user-agent string (the text your browser sends identifying its make, version and operating system). We use it for three separate purposes. First, a security activity log: when you take a significant action (for example generating or downloading a document, uploading or deleting an evidence file, inviting a teammate or requesting deletion of your account) we record the IP address and user-agent behind it, so that your organisation's Administrators can review who did what and so that we can investigate a security incident. Second, rate limiting and abuse prevention: we use the IP address of a request to limit how often the same source can call the Service and to place a temporary, self-expiring block on automated traffic, mainly on the parts of the Service that work without an account. Third, sign-up abuse prevention: we store the IP address present when your account is first created, and use it only to detect one person creating several accounts to get around free-tier limits or a promotion. It is never used on its own to decide what you can access. We also record sign-in and sign-out events for security, and error reports (including, when an error occurs, a recording of the affected session with text masked by default) through our error-monitoring provider. We do not use this data to build a personal profile of you. You cannot opt out of this collection individually while using the Service, because each purpose is part of operating and securing it.
- Trust Page and related information: where a customer chooses to publish a Trust Page, information contained in that page and related enquiries may be processed.
3. How We Use Your Data
FortressPoint uses personal data for its own controller purposes to:
- provide, operate and maintain FortressSphere;
- create and administer user and organisation accounts;
- process subscriptions, payments, invoices and billing administration;
- provide customer support and respond to communications;
- maintain security, prevent fraud and abuse, investigate incidents and administer the platform;
- generate and maintain compliance outputs and platform records where this involves FortressPoint's own account-holder relationship;
- send service, security, account-lifecycle and other necessary administrative communications;
- operate automated account-lifecycle processes for abandoned or unused accounts, as described below;
- comply with legal, regulatory, tax and accounting obligations; and
- maintain and improve the Service within the limits of applicable data protection law and the contractual arrangements governing customer data.
FortressPoint does not sell personal data. Customer-controlled content is processed only as necessary to provide the Service and in accordance with the customer's instructions and the DPA where FortressPoint acts as Processor.
The platform uses two third-party AI providers for specified AI-assisted functions, under their commercial API terms: one for text generation and answering, and one for the embeddings that support retrieval. FortressPoint does not permit either provider to use content sent through the Service to train its models, and has not opted in to any programme that would allow it. The generation provider deletes inputs and outputs within 30 days, and may keep content flagged for policy violations for up to 2 years. The embeddings provider keeps embedding requests in abuse-monitoring logs for up to 30 days.
4. Controller and Processor Roles
Unless an order form or other written agreement names a different FortressPoint entity, the Controller is FortressPoint Consulting Limited, a company incorporated in Nigeria.
FortressPoint acts as Controller for personal data it processes for its own purposes, including account administration, billing and subscription administration, direct support, platform security and administration, and other purposes for which FortressPoint determines the processing purposes and means.
For customer-controlled personal data submitted to or generated within FortressSphere, FortressPoint generally acts as Processor. This includes customer staff records, vendor and third-party contacts, personal data contained in Evidence Vault material, incident reports and other compliance content where the customer determines the purpose of the processing. The customer is responsible for having an appropriate legal basis, providing any required privacy information and responding to data-subject requests in respect of its own processing.
Where FortressPoint acts as Processor, the DPA governs the processing relationship.
Some of our service providers also act as independent controllers, under their own terms and privacy policies, for limited data they hold about the people who use the Service. Our identity provider holds sign-in account information such as names, email addresses and login credentials. Our email delivery provider holds its own account and email delivery-log data. Our payment provider carries out its own fraud-prevention and legal compliance checks on payments, as well as acting as our processor for payment processing. The DPA treats these providers as sub-processors only for the personal data they process on our behalf.
5. Legal Basis for Processing
Where FortressPoint acts as Controller in Nigeria, processing is carried out under the Nigeria Data Protection Act 2023 and applicable implementing requirements, including the General Application and Implementation Directive. Depending on the circumstances, the relevant basis can include performance of a contract, compliance with a legal obligation, consent where separately obtained, or a legitimate interest that is not overridden by the interests or rights of the individual.
Where UK GDPR applies to FortressPoint's processing, the relevant lawful basis will depend on the particular processing activity and may include performance of a contract, compliance with a legal obligation, legitimate interests or consent. We do not rely on continued use of the Service as a substitute for consent where consent is legally required.
6. Who We Share Your Data With
We share personal data with service providers who help us operate and provide FortressSphere. These providers are engaged under contractual terms requiring them to protect personal data appropriately.
This is specified below:
| Category of provider | What they do |
|---|---|
| Identity and account management | Processes authentication, account and organisation-management information. Also acts as an independent controller for sign-in account information. |
| Cloud database hosting | Hosts the platform database including account storage, organisation and customer data. |
| AI processing providers (two) | Support AI-assisted functionality, including self-audit guidance, the AI Compliance Assistant and processing of evidence to support retrieval and questionnaire-related features. |
| Payment processing | Handles payment and subscription billing, as our processor and, for its own fraud prevention and legal compliance, as an independent controller. |
| Email delivery | Handles transactional and notification email. Also an independent controller for its own account and delivery-log data. |
| Application hosting, file storage and analytics | Provides application hosting, storage of generated documents, Service content and cookieless analytics. |
| Error monitoring / observability | Provides error monitoring and diagnostic services, including session replay when an error occurs. Data is stored in the European Union by configuration. |
We do not sell your personal data to any third party.
We do not publish the names of our providers on the open web. Our Sub-Processors Register, which gives the name of each of our sub-processors, what each does and where each processes data, is available to account holders in the Service under Settings, Legal, and to anyone else on request. Please contact compliance@fortresspointconsulting.com.
7. International Data Transfers
Where our providers process personal data is set out below.
| Provider category | Where personal data is processed |
|---|---|
| Cloud database hosting | Database stored in Ireland (European Union). The provider's staff may access it from other countries for support and operations. |
| Application hosting, file storage and analytics | Application servers run in London, United Kingdom. The provider does not specify a region for file storage or analytics, which may involve the United States. |
| Error monitoring | Stored in the European Union by configuration. The provider is a United States company, and its terms allow processing in other countries, including the United States. |
| Identity and account management | United States, under the provider's certification to the EU-US Data Privacy Framework and its UK Extension. The provider offers no regional hosting option. |
| AI processing providers (two) | United States. |
| Payment processing | Nigeria. The provider uses its own sub-processors in several other countries, including the United States and the United Kingdom. |
| Email delivery | United States, under the provider's certification to the EU-US Data Privacy Framework and its UK Extension. |
We may move the platform database to the United Kingdom in future. If we do, we will update this section.
The transfer position is assessed on a provider-by-provider basis rather than through a single blanket statement. Transfers from the UK to Ireland and to other countries in the European Economic Area are covered by the UK's adequacy regulations. For transfers to the United States, FortressPoint relies on each provider's own mechanism, which may be the UK-US Data Bridge or Data Privacy Framework where the provider is certified, or standard contractual clauses, the International Data Transfer Agreement or the UK Addendum. Our agreements with these providers are currently held by FortressPoint's Nigerian entity. Personal data originating in Nigeria is transferred outside Nigeria only where the Nigeria Data Protection Act 2023 permits, that is to a recipient in a country with adequate protection or subject to appropriate safeguards. We apply the data transfer and data protection terms in our provider agreements, together with our own security measures, to those transfers. Some providers' terms also allow them and their own sub-processors to process data in other countries, for example for support, and we do not control that.
8. Data Retention and Deletion
FortressPoint retains personal data only for as long as it is needed for the relevant purpose, subject to legal, accounting, security and contractual requirements. When an individual member deletes or leaves an account, their personal account information is deleted or anonymised as applicable. Security log entries are kept for the periods shown below, including after an account is deleted.
Retention periods differ depending on the category of information.
| Category | Current retention/lifecycle position |
|---|---|
| Personal account data | A 14-day grace period follows an account-deletion request before deletion/anonymisation proceeds, subject to records that must be retained by law. |
| Record of acceptance of the Terms | Kept while the account exists. It records the user, the organisation if any, the version accepted, the page it was accepted on and the time. It does not store an IP address or browser details. When the account is deleted, the record is kept for a further 6 years, the period in which a contractual claim can be brought, without your name or email address: only the version, the page, the time and a one-way coded reference that can be matched to your email address if you or we need to show what was agreed. It is then deleted. |
| Compliance content, evidence, chat history and AI System Register / DPIA records | Kept while the account or organisation exists and deleted when it is closed. No separate automated retention limit applies to this content while the account is active. |
| Financial and invoice records | Certain financial records are retained for up to 6 years for legal, tax and accounting purposes. Personal linkage is reduced/anonymised where the system permits. |
| Customer-facing activity logs | 90 days. |
| Platform administrator action logs | 5 years for audit purposes. |
| Sign-in and sign-out (session) events | 1 year. |
| System security and health logs | Tiered by event type: 90 days for routine job records, 1 year for job failures and health events, and 5 years for security events. |
| Staff records processed for a customer | 12 months after deactivation, subject to the customer's instructions and the DPA. |
| Vendor records processed for a customer | 24 months after the vendor's last activity, subject to the customer's instructions and the DPA. |
| Trust Page enquiries | 24 months. |
| Demo/public enquiries where applicable to the Service | 24 months from the last interaction. |
| IP abuse-prevention data | Approximately 24 to 48 hours. |
| IP address stored at account creation | Kept on the account record and cleared when the account is deleted. |
| Orphaned organisations | A 90-day grace period followed by deletion where the organisation has no remaining members and the deletion criteria are met. |
| Incomplete verified sign-ups | Up to 90 days following verification, with staged reminders. |
| Empty, content-free free accounts | Automated lifecycle management may result in deletion after approximately 9 months of inactivity following warning communications. |
| Accounts containing real retained content | These are not subject to automatic deletion under the re-engagement flow; deletion requires the account holder's affirmative action through the designated consent link. |
| Backups | Backup copies expire in the ordinary course, currently up to 14 days after the live data is deleted. |
9. Your Rights
Where FortressPoint acts as Controller, your applicable rights include rights of access, rectification, deletion/erasure, objection, restriction and data portability, and, where processing is based on consent, the right to withdraw that consent.
Where FortressPoint acts as Processor, requests relating to customer-controlled personal data should normally be directed to the relevant customer/controller. FortressPoint will provide assistance in accordance with the DPA and applicable law rather than determining the customer's purposes on its behalf.
Requests concerning FortressPoint's own Controller processing may be sent to compliance@fortresspointconsulting.com or through the in-Service support mechanism. Complaints may also be escalated to the relevant supervisory authority, which is the Nigeria Data Protection Commission in Nigeria and the Information Commissioner's Office in the UK, where applicable.
10. Automated Processing and AI-Assisted Features
FortressSphere contains automated and AI-assisted features including compliance scoring, the AI Compliance Assistant, proactive reminders, vendor-risk recommendations, AI-assisted questionnaire drafting, AI-generated compliance documents, AI System Register/DPIA workflows and regulatory-update monitoring. These functions are designed to provide information, recommendations or draft material for customer review and do not purport to make final legal, employment or regulatory decisions on behalf of customers.
A separate automated account-lifecycle process can send reminders and, for abandoned or empty accounts, ultimately delete an account after the applicable warning period. Accounts containing real retained content are not automatically deleted through the re-engagement process; deletion requires affirmative action by the account holder.
A failed subscription payment can result in paid functionality being suspended or a subscription reverting to the applicable free state. If you believe a suspension occurred in error, contact FortressPoint so that the position can be reviewed.
11. Cookies and Analytics
The Service uses essential cookies necessary for authentication and maintaining signed-in sessions. We do not currently use non-essential tracking or advertising cookies. Our hosting provider supplies cookieless, aggregate statistics about which pages are visited; it does not retain raw IP addresses for this purpose and we do not use it to identify you.
12. Children's Data
FortressSphere is intended for business and professional use and is not directed at children. We do not seek to collect children's personal data through the Service.
13. Security
FortressPoint applies technical and organisational measures appropriate to the nature of the Service, including encryption in transit and at rest, access controls, role-based permissions, server-side authorisation checks, rate limiting, file-content validation, security headers, administrator and security logging, monitoring and automated security/dependency checks. The platform also maintains backup and account/company deletion processes.
14. Changes to This Policy
We may update this Policy when the Service, our processing, legal requirements or relevant contractual arrangements change. We will provide notice of material changes through the Service, by email or by another appropriate means before they take effect where required.
15. Contact and Complaints
If you have a complaint or concern about how FortressPoint has handled your personal data, including how your data has been collected, used, stored, disclosed or otherwise processed, please contact us at compliance@fortresspointconsulting.com or raise it through the in-Service support ticket form (selecting the appropriate category).
We will review and respond to your complaint in accordance with applicable data protection law.
Where your personal data has been provided to FortressSphere by one of our customers and FortressPoint is acting as that customer's Processor, complaints or concerns relating to the customer's use of your personal data should normally be directed to the relevant customer in the first instance. FortressPoint will assist the customer in dealing with the complaint where required under the applicable data protection law.