Privacy Policy

Controller and scope

The controller responsible for processing personal data under the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR) is:

n'cloud.swiss AG
Generationenweg 1
5707 Seengen, Switzerland
Phone: +41 62 511 82 82
Email: info@nguard.swiss

n'guard.swiss is a brand and product of n'cloud.swiss AG. This policy applies to visiting and using the n'guard.swiss website, including the Cyber Threat Monitor, the Weekly Cyber Report, the free threat intelligence tools described in section 4, the contact form and the whitepaper download. Section 12 additionally applies to the Android app «n'guard Cyber Intelligence». Other websites of n'cloud.swiss AG may be subject to their own privacy policies.

n'guard.swiss is aimed exclusively at companies and professionals in the field of cyber security (B2B) and is not intended for consumers or minors.

Principles and legal bases

We process personal data in accordance with the principles of good faith, proportionality, purpose limitation and transparency. We only collect data that is necessary for the purpose concerned (data minimisation), do not retain it for longer than needed, and protect it against unauthorised access with appropriate technical and organisational measures.

This statement is based on the revised Swiss Federal Act on Data Protection (FADP), in force since 1 September 2023. Depending on the purpose, we base the processing of your personal data on the following grounds:

• Contract or pre-contractual measures: processing your enquiry via the contact form, sending you a requested test result, and preparing any engagement.
• Consent: use of Google Analytics, push notifications from the app, and sending further technical information after a whitepaper download.
• Legitimate interest: operation, security and abuse protection of the website and the app (server log files, Cloudflare, Akismet, rate limiting of queries), detection of abusive use of the free threat intelligence tools, and consistent presentation of the website.
• Legal obligation: retention and disclosure of data where required by authorities or by law.

The GDPR applies in addition where we deliberately offer goods or services to people located in the EU or EEA, or monitor their behaviour there (Art. 3 (2) GDPR). n'guard.swiss is aimed primarily at companies in Switzerland; we do not deliberately target the EU/EEA market. Where the GDPR nevertheless applies in an individual case, we voluntarily align with its requirements on transparency and data subject rights.

What data we process

3.1 Server log files (automatic)

When you visit n'guard.swiss, our infrastructure and the service providers we use (see section 13) automatically collect technical data transmitted by your browser:

• IP address (truncated or pseudonymised where technically possible)
• Date and time of the request
• Page or file requested and volume of data transferred
• Referring URL (referrer), if available
• Browser type, version and operating system

This log data is used to deliver the website technically, to detect faults and abuse, and for IT security. It is not combined with other data sources unless this is necessary to defend against a specific attack. The same applies to requests made by the app under section 12.

3.2 Contact form

When you use our contact form, we process the information you enter: first name, last name, email address, company and your message. Mandatory fields are marked accordingly; all other information is provided voluntarily. We use this data solely to process and answer your enquiry and, if it leads to an engagement or contractual relationship, to prepare and carry it out.

3.3 Whitepaper download

To download our whitepaper, we collect your email address and send you the access link by email; the document is not sent as an attachment. Your registration details are used solely to deliver the requested document and, if you have separately consented, to send you further technical information. You can withdraw your consent at any time via the unsubscribe link or by email to info@nguard.swiss.

3.4 Cyber Threat Monitor, Weekly Cyber Report and threat landscape widget

The Cyber Threat Monitor, the Weekly Cyber Report and the site-wide widget display aggregated, publicly available statistics on the Swiss cyber threat landscape, based among other things on information from the Federal Office for Cybersecurity (BACS), ransomware statistics from ransomware.live and trade media (including Heise Security and The Hacker News). The weekly n'guard assessment is editorially supervised and partly produced with AI support from these public statistics. No personal data of visitors is collected, analysed or transmitted to the language model providers used for text generation for these functions; only the public figures mentioned are processed. n'guard collects and interprets this data but does not conduct its own threat research and gives no guarantee of the completeness of the underlying third-party sources.

The interactive assessment tools are described separately in section 4.

Cyber Threat Intelligence tools

On n'guard.swiss we provide free tools for assessing the cyber threat landscape. This section describes which data is processed in the process. It applies to the pages Cyber Threat Intelligence, Dark Web & Exposure Check, Ransomware Intelligence, IOC Radar, DDoS Intelligence and Threat Reports. The tool pages can also be saved to your home screen as a web app or displayed as a widget on your start screen; the same information applies as when you access them in the browser.

4.1 Dark Web & Exposure Check

For the Dark Web & Exposure Check, you enter a domain, for example company.ch. If you enter an email address instead, we use only the part after the @ sign; the name part is discarded and not stored.

The check itself runs on our servers. We query publicly available sources about this domain and check the domain's externally accessible systems for encryption and security features. Only counts, severity levels and technical details are displayed.

What we store. For each completed check, we store the domain checked, the time, the score determined (Exposure Score), the number of findings, and an eight-character, irreversible identifier calculated from your IP address. Your IP address itself is not stored and cannot be recalculated from this identifier. The identifier is used to detect repeated or automated queries. Only the last 300 checks are stored at any time; older entries are overwritten automatically.

Purpose and legal basis. We store this data to detect and prevent misuse of the free tools and to analyse their use internally. This is based on our overriding interest in the secure and reliable operation of our services (Art. 31 para. 1 in conjunction with para. 2 let. a FADP; for individuals in the EU, Art. 6 para. 1 let. f GDPR). A domain is, as a rule, information about a company and not about an individual.

Results and technical caching. We cache the results of a check for up to 24 hours, and incomplete results for ten minutes, so that the same query does not place unnecessary load on the data sources used. The number of checks per visitor and hour is limited, see section 4.6.

4.2 Unlocking the details and sending the result

The score, rating and findings of the Dark Web & Exposure Check are displayed without you providing any data. You unlock the technical details of the findings and the resulting measures by having the result sent to you. For this we collect your first name, last name, business email address and, if provided, your company. Your browser stores locally that the details have been unlocked (section 5).

The email address must belong to the domain checked; we verify this on the server side. This ensures that results for a domain only go to people who can be attributed to that organisation.

We use this information to send you the result and, if you wish, to offer you a conversation about the findings. The legal basis is the performance of pre-contractual measures at your request (Art. 6 para. 1 let. b GDPR) or your consent. The information is not used for a newsletter and is not passed on to third parties. We retain it for as long as is necessary to process your request and any follow-up questions, but for no longer than two years after the last contact.

4.3 IOC Radar

In the IOC Radar you can have an IP address, a domain, a URL, a file hash or a CVE number checked. The input is transmitted to the public sources named in section 4.5 and the result is cached for up to six hours. We do not store individual queries, only an overall counter with no link to the request. Please do not enter any personal data in the search field.

4.4 Ransomware Intelligence, DDoS Intelligence and Threat Reports

These pages display analysed data from public sources. You do not enter anything; the only thing stored is the short-lived counter used to limit queries in accordance with section 4.6. The pages name organisations that the attacker groups themselves have listed on their leak sites. We do not add any names and do not assess individual cases. Affected organisations can contact us using the contact details given in section 20.

4.5 Transfer to third parties and disclosure abroad

For the analysis we access publicly available services. The domain or indicator you have entered is transmitted to the respective service. The query is made from our servers, so your IP address is not passed on. Depending on the tool, the following are used:

• Google Public DNS (Google LLC, USA) for querying DNS records
• crt.sh, operated by Sectigo Limited (United Kingdom), and Cert Spotter (SSLMate, Inc., USA) for public certificate logs
• Have I Been Pwned (Superlative Enterprises Pty Ltd, Australia) for the catalogue of known data breaches
• Hudson Rock Ltd (Israel) for information on infostealer infections
• ransomware.live (Julien Mousqueton, France) for the analysis of leak sites
• Spamhaus Technology Ltd (United Kingdom) for reputation data on domains and addresses
• Shodan (Shodan LLC, USA) and RIPE NCC (Netherlands) for information on reachable services and networks
• RDAP via rdap.org for registration data on domains and addresses, with forwarding to the relevant registry
• SANS Internet Storm Center (USA) for information on reported sources of attacks
• abuse.ch with URLhaus, ThreatFox and MalwareBazaar (Switzerland) for information on malware and threat indicators
• CIRCL hashlookup (Computer Incident Response Center Luxembourg) for comparison against known legitimate files
• The NIST National Vulnerability Database, CISA Known Exploited Vulnerabilities, FIRST EPSS and the CVE Program (MITRE), all USA, for information on vulnerabilities
• Cloudflare Radar (Cloudflare Inc., USA) for information on the DDoS situation

Some of these services are based in countries whose level of data protection does not correspond to the Swiss level in every respect. The disclosure is limited to the domain or technical indicator queried and is based on Art. 16 and 17 FADP.

4.6 Protection against automated queries

All interfaces of the tools can be accessed without logging in. To prevent third parties from using them as a data source, the number of queries per visitor and hour is limited. For this purpose, a counter linked to a hash value of your IP address is kept for no longer than one hour. The same applies to requests made by the app.

We additionally protect the Dark Web & Exposure Check with Cloudflare Turnstile, a service of Cloudflare Inc., USA. Turnstile checks, without puzzles, whether the request comes from a human. In doing so, technical information about your browser and connection is transmitted to Cloudflare. Further information can be found in the Cloudflare privacy policy and in section 7.

4.7 Internal analysis

The stored checks can be viewed by authorised n'guard employees via a password-protected page that is not publicly linked, and via the website administration. On request, completed checks are additionally reported by email to an internal address. These reports contain the domain checked, the score, the most serious findings and the origin identifier described above.

Cookies, local storage and similar technologies

Cookies are small text files that are stored on your device. We distinguish between:

• Strictly necessary cookies, which are required for the basic operation of the website (e.g. security and form functions). These cannot be deactivated.
• Functional and analytics cookies (e.g. Google Analytics), which we only set with your consent.

When you first visit n'guard.swiss, a cookie notice asks for your consent to non-essential cookies. You can change your selection at any time via your browser settings or the cookie notice, and withdraw your consent with effect for the future.

Some functions of the Threat Intelligence tools also store small items of data in your browser's local storage (localStorage and sessionStorage). These include whether the details of the Dark Web & Exposure Check have been unlocked, whether the section ‘Background, sources and frequently asked questions’ is open and, in the web app view, whether the loading screen has already been shown and the remaining tool pages have been preloaded. This data stays on your device, is not transmitted to us and is used solely for operating the tools. Data in sessionStorage expires when you close the browser or the app. You can delete the rest at any time via your browser settings.

Google Analytics

We use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, USA), to analyse the use of n'guard.swiss statistically and to improve our offering.

Google Analytics uses cookies and similar technologies that collect, among other things, the following information: pages viewed, time spent on the site, source of the visit, approximate location data, and device and browser information. This data is combined into usage profiles under a pseudonymous identifier and analysed statistically. We have no means of identifying you personally in the process.

It is only used if you have given your consent via our cookie notice. Without your consent, no analytics script is loaded. You can withdraw your consent at any time with effect for the future, for example via the cookie notice or the browser add-on to deactivate Google Analytics.

Cloudflare (CDN and Turnstile)

We use services provided by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, to deliver n'guard.swiss and the threat landscape data for the app securely and with high performance (content delivery network, DNS), and to protect our contact form and the Dark Web & Exposure Check from automated access and spam using Cloudflare Turnstile. Turnstile checks technical characteristics of the access in the background (including IP address and device signals), without requiring you to solve a traditional image or text CAPTCHA.

The legal basis is our legitimate interest in a secure, available and abuse-free website. Cloudflare acts as our data processor on the basis of corresponding data processing agreements.

Spam and abuse protection

In addition to Cloudflare Turnstile, we use Akismet, provided by Automattic Inc., USA, to detect spam submissions via our contact form. In doing so, the IP address, form content and technical metadata are transmitted to Akismet and automatically checked for spam characteristics. We also use an invisible form field (a so-called honeypot), which is not visible to humans and only detects automated form-filling programs. No additional personal data is collected in the process. The legal basis is our legitimate interest in a functioning, abuse-free contact form.

Google Maps

To show our location on the contact page, we embed Google Maps, a mapping service provided by Google Ireland Limited (parent company: Google LLC, USA). When you open the contact page, your IP address is transmitted to Google, as this is technically necessary to display the map. By using Google Maps, you enter into a direct user relationship with Google, and its privacy policy and terms of use apply.

Fonts (Google Fonts)

For a consistent appearance, individual pages of n'guard.swiss, including the Threat Intelligence tools, the Cyber Threat Monitor, the Weekly Cyber Report, the threat landscape widget and this privacy policy, load the fonts Inter and JetBrains Mono from Google Fonts, a service provided by Google Ireland Limited (parent company: Google LLC, USA). Your browser connects to Google's servers and, as technically required, transmits your IP address together with information about your browser and operating system. According to Google, no cookies are set in the process and the data is not used for profiling.

The legal basis is our legitimate interest in a consistent and easily legible presentation of our offering. For disclosure abroad, see section 14. Further information is available in Google's privacy policy.

Social media links

On n'guard.swiss, we refer to our profiles on LinkedIn, Instagram, Facebook and X using simple links. When you open n'guard.swiss, no content or scripts from these platforms are loaded and no data is transmitted to them. This only happens once you actively click a link and visit the platform concerned. The respective providers are responsible for data processing on the linked profiles, and their own privacy policies apply.

n'guard Cyber Intelligence app

For our Android app ‘n'guard Cyber Intelligence’, the section on the app in the ncloud.swiss privacy policy applies. It describes the app in full. The following is relevant for the n'guard.swiss website:

• Retrieval of situational data: The app works without an account and retrieves the situational data via the n'guard.swiss interfaces. In doing so, our server processes, as technically necessary, your IP address, the app version and the time of the request. To limit abuse, a counter linked to a hash value of the IP address is stored for one hour at most (section 4.6).
• Push notifications: These are voluntary and are delivered via Firebase Cloud Messaging of Google Ireland Limited or Google LLC, USA. We send messages to topics, not to individual devices, and we do not store any tokens or device identifiers.
• No advertising, no analytics: The app contains no advertising, no usage analytics and no crash reports.
• Tools in the browser: If the app opens an n'guard.swiss tool in the browser, such as the Dark Web Report or the IOC Radar, this privacy policy applies to it.

Recipients and processors

We only disclose personal data where this is necessary to provide our services, to meet legal obligations or on the basis of a legitimate interest. The following overview shows the main recipients in connection with n'guard.swiss:

We do not sell personal data to third parties. Data is disclosed to law enforcement or other authorities only where we are legally obliged to do so or where this is necessary to protect our legitimate interests, for example to defend against an attack.

All processors we use are contractually bound to confidentiality and to appropriate technical and organisational protective measures, and may not use the data for their own purposes.

Disclosure of personal data abroad

As set out in section 13 and section 4.5, we use certain service providers whose registered office or server location is outside Switzerland, including in the USA. Such disclosure only takes place to countries with a level of data protection recognised as adequate by the Federal Council or, where this is not the case, on the basis of suitable safeguards under Art. 16 f. FADP, in particular the Swiss-U.S. Data Privacy Framework (where the recipient concerned has joined it) or standard contractual clauses (SCCs). A copy of the relevant safeguards can be requested from our data protection officer.

Retention period

We retain personal data only for as long as is necessary for the purpose concerned or a statutory retention obligation applies:

• Enquiries via the contact form: until final processing, then generally for a maximum of 24 months to keep a record of the correspondence, unless a contractual or customer relationship arises or a longer statutory retention obligation applies.
• Whitepaper sign-ups: until you withdraw your consent or the mailing list is deleted.
• Log of the checks in the Dark Web & Exposure Check: the last 300 entries in each case, with older entries overwritten automatically.
• Cached check results: 24 hours at most, and six hours at most for the IOC Radar.
• Counter limiting the number of queries per visitor, on the website and in the app: one hour at most.
• Details from the unlocking of a check result: two years at most after the last contact.
• Push notifications of the app: We do not store any tokens. At Google, the token remains in place until you switch off notifications in the app or uninstall the app.
• Server log files: generally a few weeks, unless they are needed for longer to investigate a specific security incident.
• Analytics data (Google Analytics): in line with the retention period we have configured, which is 14 months at most.

Data security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse or alteration. These include, among other things, encrypted transmission of all content via TLS/SSL, role-based restriction of internal access rights, regular security updates and the use of bot and spam protection in accordance with sections 7 and 8. However, the transmission of data over the internet can never be entirely free of risk, so we cannot guarantee absolute protection.

If a data security breach is likely to result in a high risk to the personality or fundamental rights of the individuals concerned, we will notify the Federal Data Protection and Information Commissioner (FDPIC) without delay and inform the individuals concerned where this is necessary for their protection or required by law (Art. 24 FADP).

Automated individual decisions and profiling

We do not make automated individual decisions that have legal or similarly significant effects on you, and we do not carry out profiling within the meaning of Art. 5 lit. f and g FADP. The use of AI to produce the threat landscape assessment (section 3.4) relies exclusively on public, non-personal statistics and is subject to editorial review.

The score determined in the Dark Web & Exposure Check is calculated according to fixed technical rules, relates to the domain checked rather than to you as a person, and has no legal effect.

Your rights

Under the applicable data protection law, you have the following rights in particular with respect to us:

To exercise your rights, contact us at info@nguard.swiss or contact our data protection officer directly as set out in section 20. If your request relates to a check carried out with one of our threat intelligence tools, please state the domain checked and the approximate time, so that we can match the entry. You also have the right to lodge a complaint with the competent supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch. Where the GDPR applies, you may also contact the competent supervisory authority in your EU or EEA country of residence.

Changes to this privacy policy

We will amend this policy whenever our data processing, the services we use or the legal framework change. The version published on n'guard.swiss at the time of your visit is the one that applies; you will find the date of the last revision at the top of this page.

Contact

If you have any questions or concerns about this privacy policy or about exercising your rights, our data protection officer is at your disposal:

Dennis Matter
Data Protection Officer
n'cloud.swiss AG
Generationenweg 1
5707 Seengen, Switzerland
Phone: +41 62 511 82 82
Email: info@nguard.swiss