MetisGrid ("MetisGrid", "we", "us" or "our") provides MetisForge and related services for cybersecurity exercises, training and readiness activities (the "Service").
This Privacy Notice explains how MetisGrid collects, uses, discloses and protects personal information.
Controller identity and contact
MetisGrid P.O. Box 1105 Wilmington, DE 19899, USA privacy@metisgrid.com
Capitalized terms not defined here have the meanings in the Terms of Service.
1. Our Roles
MetisGrid processes personal information in two capacities.
Customer Personal Data (MetisGrid as processor)
When an organization ("Customer") uses MetisForge and provides personal information through exercises, documents, responses, reports or other Customer Content, the Customer determines why and how that information is processed.
In those circumstances:
- the Customer acts as controller, business or equivalent responsible party; and
- MetisGrid acts as processor, service provider or equivalent processing party.
Processing is governed by the Customer's agreement with MetisGrid and the Data Processing Addendum ("DPA"). Sections 2 through 9 of this Notice describe that processing for transparency. Individuals whose information is in Customer Content should direct questions and requests to the Customer (see Section 11).
MetisGrid Business Data (MetisGrid as controller)
MetisGrid acts as a controller for information it processes for its own purposes:
- account registration and administration;
- business and sales contacts;
- billing and payment records;
- security of the Service;
- support communications;
- marketing to business contacts;
- legal compliance; and
- operation of the MetisGrid website.
2. Information We Process
Account information
- name;
- work email address;
- organization and job title;
- account identifier;
- role and permissions within the Service;
- authentication information (MetisGrid does not store passwords in readable form); and
- account status.
Customer Content
Customer Content may include tabletop scenarios, injects, exercise responses, chat or discussion content, facilitator notes, scoring information, reports, training records, knowledge-library content and documents uploaded by Users. Customer determines what information it places in Customer Content.
Usage and security information
- sign-in events;
- security events;
- actions taken within the Service;
- administrative changes;
- device and browser information;
- IP addresses;
- error logs and diagnostic information; and
- Service-performance information.
AI usage information
Where an AI feature is used: the content necessary to perform the request, the requested feature or action, timing and usage information, processing metadata and generated output.
Communications
Information you provide when you communicate with us concerning support, security, privacy, sales or other business matters.
Website visitor information
When you visit metisgrid.com: IP address, browser and device information, pages viewed, referring page, and any information you send us by email.
3. Sources of Information
We obtain personal information:
- directly from you, when you register, use the Service or contact us;
- from your organization, when a Customer administrator creates your account, adds you to an exercise or includes information about you in Customer Content;
- automatically, through your use of the Service and website; and
- from business-information or referral sources for sales contacts.
If your information was provided by your organization, your organization is the controller of that information and determines why it was provided.
4. How We Use Information
MetisGrid uses personal information to:
- provide and operate the Service;
- authenticate Users and administer accounts;
- perform Customer instructions;
- generate requested AI functionality;
- provide technical and customer support;
- secure the Service and detect misuse;
- investigate security events;
- maintain reliability and performance;
- administer subscriptions and business relationships;
- send service communications, including notices of changes to terms, security notices and billing information;
- send marketing communications to business contacts, subject to Section 13;
- comply with law;
- protect legal rights; and
- enforce applicable agreements.
MetisGrid does not:
- sell Customer Content;
- use Customer Content for advertising;
- use Customer Content to train AI or machine-learning models, except where a Customer expressly requests model configuration for its own use; or
- sell personal information or share it for cross-context behavioral advertising.
5. Lawful Bases Where GDPR or UK GDPR Applies
| Processing activity | Lawful basis |
|---|---|
| Providing the Service to a Customer, administering accounts, performing contractual obligations | Contract (Article 6(1)(b)) |
| Securing the Service, preventing fraud and misuse, maintaining reliability, providing support, managing business relationships, protecting legal rights | Legitimate interests (Article 6(1)(f)) |
| Marketing to business contacts | Legitimate interests, or consent where required by local law |
| Compliance with legal obligations, including tax, accounting and responding to lawful requests | Legal obligation (Article 6(1)(c)) |
| Optional cookies or analytics, where introduced | Consent (Article 6(1)(a)) |
Where we rely on legitimate interests, we have assessed that those interests are not overridden by the rights and interests of affected individuals. You may object to processing based on legitimate interests as described in Section 11.
For Customer Personal Data, the Customer is responsible for determining the lawful basis.
6. AI Processing and Automated Decisions
Some Service functions use third-party AI providers acting as subprocessors. When an AI feature is used, MetisGrid sends the AI provider the information reasonably necessary to perform the requested function.
MetisGrid uses access-control and tenant-isolation mechanisms designed to restrict information included in AI requests to information authorized for the applicable User or Service operation. AI providers do not receive autonomous access to a Customer's MetisGrid environment.
MetisGrid requires AI subprocessors processing Customer Content not to use that content to train their models except where the Customer expressly authorizes such processing.
AI-generated output may be inaccurate or incomplete and should be reviewed by an appropriate person before it is relied upon.
Automated decision-making
MetisGrid does not make decisions about individuals that produce legal effects or similarly significant effects solely by automated means. AI-assisted scoring of exercise responses is advisory and is presented to a facilitator or administrator designated by the Customer, who may review and override it before any evaluation is finalized. Customers are responsible for how they use scoring information within their organizations.
7. Information You Should Not Submit
The Service is intended to process cybersecurity exercise and readiness information, including confidential technical information where reasonably necessary.
Do not submit passwords, private cryptographic keys, authentication secrets, payment-card data, government identification numbers, protected health information or other specially regulated personal information, unless MetisGrid has expressly agreed in writing that the Service may process that category of information. Fictional data created for exercise purposes is permitted.
Customers should minimize unnecessary personal information in exercise materials and reports.
8. How We Disclose Information
Service providers and subprocessors
We use providers for cloud hosting, databases, authentication, email delivery and AI processing. Those providers process information under contractual restrictions appropriate to their role. The current list is published on the Subprocessor List page.
Within Customer organizations
Information is accessible to other Users within the same Customer organization based on permissions, roles, exercise configuration and administrator settings.
Legal purposes
We may disclose information where reasonably necessary to comply with applicable law or legal process, respond to lawful governmental requests, establish or defend legal claims, or protect the rights, safety and security of MetisGrid, Customers, Users or others.
Where legally permitted, MetisGrid will notify an affected Customer before disclosing Customer Content in response to compulsory legal process and will seek to limit the scope of disclosure.
Business transactions
Information may be transferred as part of a merger, acquisition, financing, restructuring or sale of all or part of the business, subject to applicable law and appropriate confidentiality protections. We will notify affected Customers of any such transfer that changes the controller of their information.
9. Security
MetisGrid maintains administrative, technical and organizational safeguards designed to protect information against unauthorized access, acquisition, use, alteration and disclosure. These are described in the Security Addendum, which forms part of the Customer agreement.
No method of transmission, storage or information-security control can guarantee absolute security.
10. Data Retention
Customer Content
Retained while the Customer maintains the applicable Service, then exported or deleted according to the Terms of Service and DPA: a 30-day export period after termination, deletion from active systems within 30 days after that, and purge from backups within 90 days after deletion from active systems. Backup copies are not used for ordinary business purposes.
AI processing content
Content sent to an AI provider is retained by the provider for a limited period under its commercial terms for safety and abuse monitoring (currently 30 days), and is not used to train the provider's models. MetisGrid retains AI request and response content within the Service as part of Customer Content. Usage metadata that does not contain substantive request content may be retained for up to 24 months for security, billing, reliability and capacity management.
MetisGrid Business Data
| Category | Retention |
|---|---|
| Account information | Duration of the account, then 90 days after closure |
| Security and authentication logs | 12 months |
| Billing and transaction records | 7 years, as required by tax and accounting law |
| Support communications | 3 years after the ticket is closed |
| Sales and marketing contacts | Until you opt out or 24 months after last interaction |
| Website visitor logs | 90 days |
Records may be retained longer where reasonably necessary to establish, exercise or defend legal claims or to comply with a legal hold.
11. Individual Privacy Rights
Depending on applicable law, you may have the right to:
- access your personal information;
- correct inaccurate information;
- request deletion;
- restrict or object to processing, including processing based on legitimate interests;
- receive a portable copy of information you provided;
- withdraw consent where processing is based on consent; and
- lodge a complaint with a supervisory authority. In the EU, you may contact the authority in your member state; in the UK, the Information Commissioner's Office.
Information in Customer Content
Where your personal information forms part of Customer Content, the Customer is the controller. Direct your request to that organization. MetisGrid will assist the Customer as required by law and the DPA, and will not independently alter or delete Customer-controlled information where doing so would conflict with the Customer's lawful instructions, unless required by law.
Information controlled by MetisGrid
Send requests to privacy@metisgrid.com. MetisGrid may need to verify your identity before completing a request and will respond within the period required by applicable law, normally within 30 days.
MetisGrid will not discriminate against you for exercising a legally protected privacy right.
12. U.S. State Privacy Laws
Residents of certain U.S. states may have additional rights under applicable state privacy law, including the right to know, delete, correct and obtain a copy of personal information, and to opt out of sale, sharing or targeted advertising.
MetisGrid does not sell personal information or share it for cross-context behavioral advertising, and does not process personal information for targeted advertising or profiling that produces legal or similarly significant effects. Because MetisGrid does not sell or share personal information, no opt-out mechanism is required; MetisGrid honors Global Privacy Control signals where applicable law requires.
Where MetisGrid becomes subject to a state privacy law, it will provide the rights and disclosures required by that law. Requests may be submitted to privacy@metisgrid.com. Authorized agents may submit requests on your behalf with written authorization.
13. Marketing Communications
MetisGrid may send marketing communications to business contacts who have expressed interest in the Service or whose organization is a Customer. Every marketing email includes an unsubscribe link. Service communications (security notices, billing, changes to terms) are not marketing and cannot be opted out of while you hold an account.
Where local law requires prior consent for marketing to business contacts, MetisGrid obtains it.
14. Cookies and Local Storage
MetisGrid uses the following categories of browser storage and technologies:
| Category | Purpose | Examples |
|---|---|---|
| Strictly necessary | Authentication, session management and security | The signed-in session, kept in browser storage |
| Functional | Remembering preferences such as theme, and keeping an unsent exercise answer until it is submitted | Browser-storage keys for theme and answer drafts |
MetisGrid does not use third-party advertising trackers, cross-site behavioral advertising or third-party analytics on the Service. Fonts and other page assets are served from MetisGrid's own site.
Strictly necessary storage does not require consent. If MetisGrid introduces analytics, advertising or other non-essential technologies, this Notice and the consent mechanism will be updated before those technologies are activated.
15. International Processing
The Service is hosted and operated in the United States. Information from Users outside the United States is transferred to and processed in the United States and in other countries where approved subprocessors operate.
For transfers of personal information from the European Economic Area, United Kingdom or Switzerland, MetisGrid relies on:
- the European Commission's Standard Contractual Clauses (Module Two), incorporated into the DPA with Customers;
- the UK International Data Transfer Addendum to the Standard Contractual Clauses;
- the Swiss adaptations recognized by the Federal Data Protection and Information Commissioner; or
- another legally recognized transfer mechanism.
MetisGrid conducts transfer risk assessments and maintains supplementary measures, including encryption in transit and at rest, as described in the Security Addendum. A copy of the relevant transfer terms is available on request to privacy@metisgrid.com.
16. Children
The Service is intended for businesses and professional Users. MetisGrid does not knowingly provide the Service to individuals under 18 or knowingly collect personal information from children. If you believe information concerning a child has been submitted contrary to this Notice, contact privacy@metisgrid.com and we will delete it.
17. Changes to This Notice
MetisGrid may update this Privacy Notice when its practices, technology or legal obligations change. The current version, with its version number and effective date, is posted at the Privacy page.
If a change materially alters how MetisGrid uses personal information, MetisGrid will notify Customer administrators of record and, where required by law, affected individuals, at least 30 days before the change takes effect.
18. Contact
MetisGrid P.O. Box 1105 Wilmington, DE 19899, USA privacy@metisgrid.com