INFORMATION DISCLOSURE AND PRIVACY POLICY

System: GhostDrill Red Team Intelligence Platform
Version: 1.0 DRAFT
Date: August 2026
FedRAMP Controls: PL-4, AC-22, PT, IP, AR (NIST SP 800-53 Rev 5 Privacy Family)
Regulatory Alignment: GDPR, CCPA/CPRA, HIPAA (data handling), FERPA (n/a)
Classification: CUI

---

1. PURPOSE

This policy documents how GhostDrill collects, uses, discloses, retains, and protects personally identifiable information (PII) and security-sensitive data, aligned with the platform's actual data architecture, entities, and user flows.

---

2. SCOPE

This policy applies to all GhostDrill data processing activities, including:

• User account information
• Pentest engagement and finding data
• Digital contract signing and identity verification records
• CVE watchlist and breach monitoring data
• Payment and subscription data (processed via Base44 Payments / Wix)
• Contact form submissions
• Blog and community content
• Security audit and log data

---

3. SYSTEM DATA ARCHITECTURE OVERVIEW

GhostDrill is a red team intelligence platform that simulates real-world security findings to assess business impact. The following data categories are processed:

| Data Category | Source | Entities / Stores | Sensitivity | |--------------|--------|-------------------|-------------| | User identity | Cognito + app | User entity, Cognito user pool | PII — High | | Pentest sessions | AI-generated | PentestSession, Finding, Simulation | Security-sensitive — High | | Engagement contracts | User-submitted | Engagement, EngagementContract | PII + Legal — High | | Identity verification | LinkedIn + AI check | EngagementContract (identity_* fields) | PII — High | | Vulnerability data | NVD API | CVE, Watchlist | Public + User-linked — Moderate | | Breach intelligence | External feeds | (display only) | Public — Low | | Contact inquiries | Contact form | Contact entity | PII — Moderate | | Payment records | Wix checkout | Subscription entity | PCI-adjacent — High | | Audit logs | System-generated | CloudTrail, CloudWatch, S3 archive | Operational — High |

---

4. INFORMATION COLLECTED

4.1 Information You Provide Directly

Account Registration (via Cognito):

• Email address (used as unique identifier and verified)
• Full name
• Password (hashed by Cognito; never stored in plaintext)
• MFA software token enrollment

Pentest Engagement Setup:

• Engagement name, client name, engagement type
• Target scope (domains, IPs, CIDRs, tech stack)
• Additional context (rules of engagement, credentials provided)
• Testing window dates

Contract Signing (EngagementContract):

• Client legal name, email, company, job title
• Target systems authorized for testing
• LinkedIn profile URL (for identity verification)
• Typed electronic signature (full legal name)
• Signature IP address and timestamp
• Liability, NDA, and ROE acknowledgments

Contact Form:

• Name, email, company, subject, message

Blog Content:

• Post title, content, author name, author email, tags

Watchlist Preferences:

• CVE IDs or product keywords being monitored

4.2 Information Collected Automatically

Technical and Usage Data:

• IP address (for geo-gating and contract signature records)
• Browser type and device information
• Access timestamps and session data
• Interaction data (pages visited, features used)

Security Audit Data:

• Authentication events (login, MFA, token issuance)
• API call records (CloudTrail)
• Entity create/read/update/delete operations
• Network flow logs
• Configuration change history

4.3 Information Collected by Third Parties

Payment Processing (Base44 Payments / Wix):

• Wix collects payment method, billing address, and buyer email at checkout
• GhostDrill receives: checkout session ID, order ID, subscription plan, amount, and currency
• GhostDrill does NOT receive or store full payment card numbers — Wix handles PCI-DSS-compliant card processing
• The buyer's email entered at Wix checkout is stored on the Subscription entity for order correlation only

Identity Verification (LinkedIn):

• LinkedIn profile URL is collected for signer identity verification
• AI-assisted verification produces a risk level (low/medium/high) and summary narrative
• LinkedIn credentials are never requested or stored

Vulnerability Data (NVD API):

• CVE records fetched from the National Vulnerability Database
• Public data; linked to user watchlists for monitoring

---

5. HOW INFORMATION IS USED

5.1 Service Provision

• Account management: Authenticate users, manage sessions, enforce role-based access
• Pentest simulation: Generate AI-driven attack scenarios, business impact assessments, and remediation roadmaps from engagement data
• Contract enforcement: Record authorized testing scope and signer identity for legal accountability
• Payment processing: Create checkout sessions, track subscription status, grant access to paid features
• Vulnerability monitoring: Track CVEs and products of interest; notify users of relevant changes

5.2 Security and Compliance

• Audit logging: All system activity is recorded for accountability and incident investigation
• Geo-gating: IP-based geolocation restricts access to US-based users (geoCheck function)
• Identity verification: LinkedIn and AI-based verification for contract signers to prevent unauthorized testing authorization
• Fraud prevention: Caller verification on backend functions; signature IP recording; anomaly detection via GuardDuty

5.3 Communications

• Security notifications (assignment, comment, status changes)
• Subscription lifecycle notifications
• Critical vulnerability alerts for watchlisted items
• Contact form responses

5.4 Service Improvement

• Aggregated, de-identified usage analytics to improve platform features
• Security finding trends to enhance simulation accuracy

5.5 Legal Obligations

• Compliance with FedRAMP audit retention requirements
• Law enforcement requests (with valid legal process)
• Breach notification obligations per applicable regulations

---

6. INFORMATION DISCLOSURE

6.1 Disclosure to Authorized Users

• Own data: Users can access their own pentest sessions, findings, simulations, watchlists, and notifications (enforced via Row-Level Security)
• Assigned data: Users assigned to findings or simulations can access those records
• Admin access: Administrators can access all records for system management and support

6.2 Disclosure to Clients (Engagement Scope)

• Engagement owners can share findings, simulations, and reports with their client organization
• Contract records (ROE, NDA) govern the scope of authorized disclosure for each engagement
• Client portal access is granted per engagement contract terms

6.3 Disclosure to Third-Party Service Providers

| Provider | Data Shared | Purpose | Safeguards | |----------|------------|---------|------------| | AWS GovCloud | All system data | Cloud hosting | FedRAMP High P-ATO; encryption at rest/in transit | | Wix Payments | Checkout session data | Payment processing | PCI-DSS compliant; DPA required | | LLM APIs (OpenAI/Google/Anthropic) | Pentest context for AI analysis | Simulation generation | Data handling reviewed; FedRAMP-authorized variants preferred | | NVD API | No user data sent | Vulnerability data retrieval | Government service | | ip-api.com | IP address | Geo-gating (US-only access) | IP only; no PII |

6.4 Disclosure Not Permitted

GhostDrill does NOT sell, rent, or trade personal information to third parties. GhostDrill does NOT use personal information for targeted advertising. GhostDrill does NOT disclose security findings or engagement data to parties outside the engagement contract scope.

6.5 Legal Disclosures

• Disclosure to law enforcement requires valid legal process (subpoena, court order)
• Breach notification to affected individuals and regulators per applicable law
• Disclosure to FedRAMP assessors (3PAO) for compliance verification under NDA

---

7. DATA RETENTION

7.1 Retention Schedule

| Data Type | Retention Period | Disposal Method | |-----------|-----------------|-----------------| | User accounts | Duration of engagement + 90 days | Account deletion; data anonymized | | Pentest sessions & findings | Duration of engagement + 1 year | Entity deletion; audit logs retained | | Simulations | Duration of engagement + 1 year | Entity deletion | | Engagement contracts | 7 years (legal/ROE records) | Contract versioning; archival storage | | Identity verification records | 7 years (signature records) | Stored in EngagementContract entity | | CVE database records | Indefinite (public data) | N/A | | Watchlists | Duration of account | Entity deletion on request | | Contact form submissions | 90 days | Entity deletion | | Blog posts | Until author deletion | Entity deletion | | Payment/subscription records | 7 years (financial records) | Subscription entity; Wix retains per PCI | | Audit logs (CloudTrail) | 365 days (object lock) | S3 lifecycle to Glacier/Deep Archive | | Long-term audit archive | 7 years | S3 lifecycle expiration |

7.2 Legal Holds

• Data subject to litigation hold is retained until hold is released, overriding standard retention.
• Legal holds are documented and communicated to the ISSO.

---

8. DATA SUBJECT RIGHTS

8.1 Access Rights

• Users can access their own data through the application interface
• Users can request a complete export of their personal data by contacting the privacy officer
• Export provided within 30 days in a machine-readable format

8.2 Rectification Rights

• Users can update their profile information (name, email) through account settings
• Users can request correction of inaccurate data by contacting the privacy officer

8.3 Erasure Rights (Right to Be Forgotten)

• Users can request deletion of their account and associated personal data
• The DeleteAccount page (src/pages/DeleteAccount.jsx) provides self-service account deletion
• Deletion exceptions: data retained for legal obligations (contracts, audit logs, financial records)
• Deletion is completed within 30 days of request

8.4 Data Portability

• Users can export their data in JSON format
• Export includes: profile, watchlists, blog posts, assigned findings/simulations (where owned)

8.5 Objection Rights

• Users can object to processing for direct communications
• Users can opt out of security notifications (may impact platform usability)

8.6 Automated Decision-Making

• AI-assisted identity verification produces a risk level (low/medium/high) for contract signers
• Users can request human review of automated identity verification decisions
• AI-generated pentest simulations are advisory; final security decisions are made by human analysts

---

9. DATA SECURITY CONTROLS

9.1 Access Control

• All data access requires authenticated Cognito sessions (IA-2)
• MFA mandatory for all users (IA-2(1)/(2))
• Role-based access via Cognito user groups: Admins, Pentesters, Users (AC-6)
• Row-Level Security (RLS) on every entity restricts data to owners, assignees, and admins

9.2 Encryption

• At rest: KMS encryption on all storage (RDS, S3, CloudWatch, ECR, Cognito, Backups, Secrets)
• In transit: TLS 1.2+ enforced on all communications (CloudFront, RDS, API calls)

9.3 Audit and Monitoring

• All data access logged via CloudTrail and application audit middleware (AU-2)
• GuardDuty monitors for unauthorized access and data exfiltration (SI-4)
• CloudWatch alarms alert on anomalous access patterns (AU-5/AU-6)

9.4 Boundary Protection

• CloudFront WAF with OWASP rules and geo-restriction (US-only) (SC-7)
• Network ACLs and security groups enforce tier isolation (SC-7(5))
• Lambda@Edge injects security headers and strips server-identifying metadata (SC-8)

9.5 Data Minimization

• Only data necessary for the stated purpose is collected
• Payment card data is never received (Wix handles PCI compliance)
• Geo-gating uses IP only; no persistent location tracking

9.6 Identity Verification for Sensitive Operations

• Contract signing requires LinkedIn + AI identity verification
• Signature IP and timestamp recorded for legal accountability
• Identity risk level assessed before contract execution

---

10. SPECIFIC DATA FLOWS

10.1 Pentest Engagement Flow

1. User creates Engagement (name, client, type, scope)
2. User creates PentestSession (target scope, type, context)
3. AI generates report, findings, and simulations from session data
4. Findings can be pushed to the Findings database for tracking
5. Simulations provide business impact analysis (FAIR-based financial estimates)
6. Contract signing required for authorized testing (ROE, NDA)

Data shared with LLM APIs: Engagement context, target scope, and additional context are sent to LLM APIs for AI analysis. No client PII beyond what is necessary for the simulation is included. FedRAMP-authorized LLM variants are preferred.

10.2 Contract Signing Flow

1. Signer provides: legal name, email, company, title, target scope
2. Signer provides LinkedIn URL for identity verification
3. AI performs identity verification (produces risk level + summary)
4. Signer acknowledges liability, NDA, and ROE
5. Signer types full legal name as electronic signature
6. IP address and timestamp recorded
7. Contract stored with version tracking; modifications create new versions

Identity data: LinkedIn profile URL, AI verification summary, and risk level are stored on the EngagementContract entity. LinkedIn credentials are never requested.

10.3 Payment Flow

1. User selects subscription plan (Business or PTaaS Pro)
2. create-checkout function creates a Wix checkout session
3. User redirected to Wix-hosted checkout page
4. Wix collects: payment method, billing address, buyer email
5. User completes payment; Wix sends ORDER_APPROVED webhook
6. Webhook verifies JWT signature (RS256), correlates via checkout session ID
7. Subscription entity updated to "active"; access granted
8. User redirected to OrderComplete page

Payment data handling: GhostDrill stores only: checkout session ID, order ID, subscription plan, status, amount, currency, and buyer email (for correlation). Full card data is handled exclusively by Wix under their PCI-DSS compliance. The buyer email is the only field linking a payment to a user — it is never used for marketing without consent.

10.4 CVE Monitoring Flow

1. fetchLatestCVEs function syncs NVD data daily (admin/service-role triggered)
2. CVEs stored in CVE entity (public data, admin-managed)
3. Users create Watchlist entries for CVEs or products of interest
4. Watchlist data is user-private (RLS: created_by_id only)
5. No user data is sent to NVD; only public vulnerability data is retrieved

10.5 Contact Form Flow

1. Visitor submits contact form (name, email, company, subject, message)
2. sendContactEmail function (caller-verified) sends to GhostDrill
3. Contact record stored in Contact entity (admin-only access)
4. Retained 90 days, then deleted

---

11. PRIVACY BY DESIGN

GhostDrill implements privacy by design principles:

• Data minimization: Only necessary data is collected at each step
• Purpose limitation: Data used only for stated purposes
• Security by default: Encryption and access controls enabled by default
• Transparency: This policy and the Privacy Policy page (src/pages/PrivacyPolicy.jsx) inform users
• User control: Self-service data access, correction, and deletion
• Accountability: Audit logs track all data access and modifications

---

12. CHILDREN'S PRIVACY

GhostDrill is a professional security platform intended for use by authorized security professionals and organizations. The platform is not directed at children under 16, and GhostDrill does not knowingly collect personal information from children. If you believe a child has provided personal information, contact the privacy officer for immediate deletion.

---

13. INTERNATIONAL DATA TRANSFERS

• GhostDrill is hosted on AWS GovCloud (US-only) with geo-restriction to US-based users
• Data is stored and processed within the United States
• No international data transfers except to LLM API providers (handled per their data processing agreements)
• GDPR-compliant data processing for EU users who access the platform (lawful basis: contract performance and legitimate interest for security operations)

---

14. BREACH NOTIFICATION

14.1 Internal Notification

• Security incidents detected by GuardDuty, Inspector, or CloudWatch trigger immediate SNS alerts
• ISSO notified within 1 hour of confirmed data breach
• Incident Response Plan (INCIDENT_RESPONSE_PLAN.md) activated

14.2 External Notification

• Affected individuals notified within 72 hours of confirmed breach (per GDPR Article 33/34)
• Regulatory authorities notified per applicable law (GDPR, state breach notification laws)
• Notification includes: nature of breach, data categories affected, mitigation steps, and contact information

14.3 Documentation

• All breaches documented in the POA&M with root cause and corrective actions
• Post-incident review conducted and lessons learned applied

---

15. PRIVACY OFFICER AND CONTACT

Privacy Officer: [DESIGNATE — ISSO or designated privacy lead]
Contact: Submit via the Contact page (/Contact) with subject "Privacy Request"
Response Time: 30 days for access, correction, and deletion requests

15.1 Request Handling

• All privacy requests are logged and tracked
• Identity verification required before disclosing personal data
• Requests are fulfilled within statutory timeframes
• Denials include rationale and appeal mechanism

---

16. POLICY UPDATES

• This policy is reviewed annually by the ISSO and System Owner
• Material changes are communicated to users via email and in-app notification
• Continued use after notification constitutes acceptance of updated terms
• Version history maintained in Git

---

17. RELATED DOCUMENTS

• PRIVACY_IMPACT_ASSESSMENT.md — Detailed PIA for the system
• ACCESS_CONTROL_POLICY.md — AC data access controls
• AUDIT_ACCOUNTABILITY_POLICY.md — AU data access logging
• IDENTIFICATION_AUTHENTICATION_POLICY.md — IA identity verification
• INCIDENT_RESPONSE_PLAN.md — IR breach response procedures
• src/pages/PrivacyPolicy.jsx — User-facing privacy policy summary
• src/pages/DeleteAccount.jsx — Self-service data deletion
• src/pages/Contact.jsx — Privacy request submission
• App entities: User, Engagement, EngagementContract, Finding, Simulation, Subscription, Contact, Watchlist, CVE, Notification, Comment, BlogPost

---

This policy is aligned with GhostDrill's actual system architecture, entity model, and data flows as implemented in the application code and Terraform infrastructure. It is a DRAFT pending 3PAO review and organizational adoption.