Legal
The privacy notice and the terms — each at a dedicated URL.
Driftlock's privacy policy and Terms of Service each live at their own canonical URL. The Privacy Policy is the SOC 2 + retention + subprocessor + data- subject posture a regulator reads on day one; the Terms of Service is the contract template counsel reviews before launch. Both share the same surface vocabulary as /security — same protection terms, same per-record fields.
privacy policy · terms of service · /legal/privacy & /legal/terms
Privacy Policy
The privacy posture a regulated reviewer reads first.
Data handling (AES-256, TLS 1.2+, customer-managed keys, data residency), retention windows per data class, named subprocessors, and GDPR / CCPA-style data-subject rights — with a contact channel that mounts the contact-form module.
- Mirrors /security's four-surface posture.
- Per-data-class retention floors (account, audit, support, billing).
- Subprocessor register (hosting, Postgres, email proxy, Stripe Connect).
Terms of Service
The contract template counsel signs off on.
Acceptance, use of the service, self-hosted deployments, audit-trail retention, liability, governing law, and changes — placeholder copy under legal review; counsel will replace each clause with the reviewed language before the service opens to self-serve sign-ups.
- Placeholder copy labelled under legal review.
- Enterprise tier governed by the contracted MSA + DPA.
- 30-day notice on material changes.
Reach the privacy + security inbox
Privacy requests, security questions, DPA negotiations — one inbox.
Privacy and data-subject requests, coordinated security disclosures, and DPA questions all flow to the same inbox. Two-business-day first response; the same channel handles cryptographic weaknesses, key-handling incidents, and supply- chain findings.