Data Security & Handling

Our Commitment to Data Security

At DTSecLabs (Digital-Tiercel Security Labs Pvt. Ltd.), we recognize that industrial asset information is sensitive and critical to manufacturing operations.

RiskMatrix is designed to help organizations understand their Operational Technology (OT) assets, identify associated cybersecurity vulnerabilities, visualize potential attack paths, and prioritize remediation activities.

We are committed to handling customer-provided information responsibly, maintaining confidentiality, limiting access, and applying appropriate security measures throughout the data lifecycle.

This statement explains how DTSecLabs collects, processes, protects, retains, and deletes information used within RiskMatrix.

What Data Does RiskMatrix Collect?

RiskMatrix processes industrial asset information supplied by customers or their authorized technology partners.

Depending on the available inventory or vulnerability data, this may include: Asset names and identification numbers. IP and MAC addresses. Equipment manufacturers, models, and device types. Firmware, software, and operating system versions. Network ports, services, and industrial protocols. Network topology and asset connectivity information. Existing vulnerability and security assessment findings.

RiskMatrix does not actively scan industrial networks or collect device credentials, passwords, encryption keys, or network packet captures.

The platform analyzes information provided through authorized data imports rather than directly interacting with production equipment.

How Is Customer Data Used?

Customer-provided data is processed to deliver RiskMatrix functionalities, including: Creating and maintaining industrial asset inventories. Mapping known vulnerabilities to relevant assets. Analyzing potential attack paths across connected systems. Identifying assets that may be exposed to significant cybersecurity risks. Generating remediation recommendations and security reports. Supporting security assessments and relevant standards mapping.

Customer data is used only for the agreed services and associated operational, security, and support purposes.

DTSecLabs does not sell customer asset information or use customer-provided data to train or improve its own or third-party AI models without separate authorization.

RiskMatrix provides analytical findings and recommendations. It does not automatically modify industrial equipment, deploy patches, or change production configurations.

Data Ownership and Confidentiality

Customers retain ownership of the industrial asset information and related records they provide to DTSecLabs.

DTSecLabs processes this information for the agreed purposes under the applicable pilot or service agreement.

Access to customer information is restricted to authorized personnel and designated customer accounts.

Information provided by one customer is logically separated from that of other customers.

DTSecLabs treats customer-provided technical information and generated security findings as confidential, subject to the applicable contractual confidentiality obligations.

Data Hosting and Security Measures

RiskMatrix is primarily delivered as a cloud-based Software-as-a-Service (SaaS) platform.

The hosting provider and geographic region are selected according to the agreed customer deployment arrangements and documented in the Statement of Work (SOW).

For AWS deployments, the security measures include: Encryption in transit: TLS-protected communication. Encryption at rest: AWS server-side encryption using AWS-managed or customer-managed keys, as configured. Access restrictions: Individual accounts for authorized DTSecLabs personnel and designated customer users. Data separation: Logical separation between customer environments. Activity logging: Records of relevant platform activities, available for review and export.

During pilot engagements, access is limited to the designated customer users and authorized DTSecLabs personnel.

Additional deployment configurations, including Azure or customer-hosted environments, are subject to separate technical and contractual arrangements.

Third-Party Services and AI Processing

DTSecLabs uses selected service providers to support RiskMatrix hosting, platform operations, communication, and AI-assisted analysis.

Depending on the deployment, these may include: AWS or Microsoft Azure: Cloud infrastructure and storage. Anthropic API: Processing of minimized, anonymized attack-path information for AI-assisted analysis. Google Workspace: Business communication and administrative services.

Raw customer asset inventories are not intentionally submitted to the AI provider as part of the attack-path analysis workflow.

Information processed by external providers may be subject to their service locations and contractual data-processing arrangements.

The location of primary cloud hosting does not, by itself, guarantee that all related processing remains within the same geographic region.

Relevant providers, data flows, and applicable data protection requirements will be addressed in the customer agreement and Data Processing Agreement (DPA), where required.

Data Retention and Deletion

Customer data is retained according to the purpose of processing and the applicable service agreement.

For pilot engagements, the retention commitment is: Customer-provided and RiskMatrix-generated pilot data is deleted within 30 days after the pilot ends. The deletion requirement includes relevant backup copies. Security, application, and access logs may be retained separately where legally required, with appropriate data minimization. Any different retention requirements must be documented in the customer agreement.

For commercial subscriptions, retention periods, export arrangements, and deletion procedures will be defined in the applicable agreement.

Security Incidents and Responsibilities

DTSecLabs maintains procedures for identifying, assessing, and responding to security incidents affecting its services or customer information.

Where an incident affects customer data, DTSecLabs will communicate with affected customers in accordance with applicable legal requirements and contractual notification obligations.

Customers remain responsible for ensuring that information shared with RiskMatrix is authorized and sufficiently accurate for the intended analysis.

Remediation recommendations should be reviewed and validated by the customer's authorized OT and security personnel before implementation in production environments.

Privacy and Compliance

DTSecLabs aims to handle customer information consistently with applicable data protection requirements, including the GDPR where relevant.

RiskMatrix can provide information that supports customers' cybersecurity risk assessments and compliance activities. However, using RiskMatrix does not, by itself, establish certification or compliance with a particular security standard.

Where customer-provided data includes personal information and DTSecLabs acts as a data processor, the applicable responsibilities will be established through contractual data protection arrangements.

For further information, please refer to our Privacy Policy and the applicable customer agreements and Data Processing Agreements.

Contact

For questions about RiskMatrix data handling, security arrangements, or customer data protection, contact:

DTSecLabs
Contact form: dtsec-labs.com/contact.html
Website: https://dtsec-labs.com

Berlin, Germany
Belagavi, Karnataka, India