Privacy & Data Handling

1. Overview

OrynIQ is a SaaS platform for ServiceNow governance, platform health analysis, and AI-assisted remediation. It connects to your ServiceNow instance via OAuth 2.0 to perform automated health checks, CMDB diagnostics, and continuous monitoring.

OrynIQ is operated by Logan Poynter LLC and hosted on Microsoft Azure. Customers access the platform via a web browser. No software is installed in your environment.

2. What Data We Process

2.1 Account & User Data

2.2 ServiceNow Connection Credentials

Credentials are never logged and are decrypted only in memory at the moment of an API call to your ServiceNow instance. The encryption key is stored separately from the database.

Payment card data is handled exclusively by Stripe. OrynIQ does not store card numbers, CVCs, full PANs, or magnetic stripe data. We retain only the Stripe customer and subscription identifiers needed to reconcile billing events.

2.3 ServiceNow Instance Data

OrynIQ queries your ServiceNow instance via its REST API using the OAuth credentials you provide. Data read may include:

• CMDB records. Configuration Items, relationships, ownership and lifecycle fields
• ITSM records. Incidents, changes, problems, and service requests (metadata and field values)
• User and role data. User accounts, roles, groups, and ACLs (used for access governance checks)
• Schema data. Custom tables, fields, and update sets (schema health and upgrade risk analysis)
• Script and automation data. Business Rules, Script Includes, and Flow Designer flows
• Asset and license data. Hardware assets and subscription records

Subsets of this data (finding details and sample records that evidence a health check result) are stored in the OrynIQ database to support reporting and trend analysis. Raw bulk data is not retained beyond what is needed to generate and support a finding.

2.4 How We Use Account & Signup Information

We use the information collected at signup and during the lifetime of your subscription for the following purposes:

• To process payments via our payment processor, Stripe, including one-time fees, subscription billing, invoicing, refund processing, and dispute handling.
• To enforce abuse-prevention measures, including duplicate-signup detection using a hash of normalized signup details (email, phone, company name).
• To deliver transactional and operational email (sign-in links, scan completion notifications, billing confirmations, dispute or refund notices).
• To support the audit and compliance posture of the Service, including SOC 2 evidence collection.

2.5 AI Interaction Data

3. How We Store Data

3.1 Infrastructure

• Hosting. Microsoft Azure (Ubuntu 22.04 LTS VM), operated and maintained by Logan Poynter LLC. Customers access the platform via a web browser. No infrastructure is deployed in your environment.
• Database. PostgreSQL 15, deployed in Docker on the same dedicated VM, not accessible from the public internet. The database port is bound to localhost only.
• Edge. Cloudflare is used for SSL termination, DDoS mitigation, and WAF protection.
• Backups. Azure disk snapshots are taken on a regular schedule. Point-in-time database recovery is available on request.

3.2 Encryption

3.3 Multi-Tenant Isolation

All customer data is isolated by customer_id at the application and database query level. No customer can access another customer's data through the application.

4. Data Retention

Customers may request full tenant data deletion at any time. Deletion is completed within 30 days of a confirmed written request.

5. Third-Party Services

5.1 Anthropic (Claude AI)

OrynIQ uses the Anthropic Claude API to power the Oryn AI investigation agent. During an AI session, user chat messages and relevant ServiceNow data surfaced by the agent are sent to Anthropic's API to generate responses.

• Anthropic does not use API inputs or outputs to train its models by default
• Anthropic's usage policy and privacy policy apply
• Token usage (not content) is logged locally for internal cost tracking
• AI features can be disabled per customer if required

5.2 Resend (Transactional Email)

OrynIQ uses Resend to deliver system emails such as user invite notifications. No marketing or promotional email is sent. Resend's privacy policy applies to email delivery metadata.

5.3 Cloudflare

All traffic to OrynIQ passes through Cloudflare for SSL termination, DDoS protection, and WAF filtering. Cloudflare's privacy policy applies to traffic metadata at the network layer.

5.4 Stripe (Payment Processing)

OrynIQ uses Stripe, Inc. as its payment processor for one-time fees, subscription billing, invoicing, refund processing, and dispute handling. Stripe is a PCI-DSS Level 1 service provider and handles card data exclusively. OrynIQ never stores, processes, or transmits raw card numbers.

Stripe Checkout sets cookies on the checkout.stripe.com domain to facilitate fraud detection and payment session continuity. These cookies are first-party to Stripe and are not set by OrynIQ. Stripe's privacy policy and data processing addendum apply.

Stripe retains payment records independently for tax and regulatory compliance per their privacy policy, distinct from OrynIQ's customer-data retention windows.

5.5 PostHog (Product Analytics)

OrynIQ uses PostHog to understand how the platform is used so we can prioritize improvements. Analytics are collected on both the marketing site (oryniq.com) and the authenticated app (app.oryniq.com), and are only enabled after you grant consent via the cookie banner. Rejecting consent stops all PostHog activity. No events, no cookies, no session recordings.

• No personal data (email, name, customer name) is included in analytics events
• Identified users are tracked under their internal user ID, with role, plan tier, and organization ID as the only traits
• Session replay is enabled on the app. Sensitive UI regions (customer names, ServiceNow URLs, finding details) are masked, and recording is blocked entirely on the AI agent (/agent/*), authentication (/auth/*), and billing (/billing/*) routes
• Session replay is not enabled on the marketing site

PostHog sets ph_* cookies (distinct ID + session ID) on .oryniq.com. These cookies are only set after consent is granted and let us link a marketing-site visit to a subsequent app session for funnel analysis. PostHog's privacy policy and data processing addendum apply. Standard Contractual Clauses cover EU-to-US transfer for users in the EU/UK.

You can revoke consent at any time from Settings → Privacy in the app. Revocation immediately stops collection, clears the ph_* cookies, and aborts any in-flight session recording.

Data deletion: see privacy@oryniq.com. Analytics deletion is handled per the runbook documented in docs/runbooks/dsar-analytics-deletion.md.

6. Access Controls

6.1 Role-Based Access

6.2 Operator Access

Logan Poynter LLC personnel do not access customer tenant data except as required for support activities explicitly requested by the customer, and only for the duration necessary to resolve the issue.

6.3 Session Security

Sessions use a sliding 1-hour inactivity window. Tokens are renewed on each authenticated API call within the active window. Session cookies are httpOnly, Secure, and SameSite=Lax.

7. AI-Proposed Remediation

OrynIQ's AI agent can propose field-level changes to your ServiceNow instance as part of remediation guidance. These proposals:

• Are never applied automatically. Every proposal requires explicit human review and approval before any write-back is executed
• Are recorded in the platform's audit log with the proposal content, reviewing user, timestamp, and outcome
• Can be reviewed, approved, or rejected individually in the OrynIQ UI

8. Audit Logging

All user and system actions are written to an immutable activity log. Each entry records:

• Event type and severity
• User identity (ID and email)
• Timestamp (UTC)
• IP address and browser user agent
• Entity affected (type and ID)
• Change detail where applicable

Audit logs cannot be modified or deleted through the application. Minimum retention is 12 months.

9. Your Rights & Controls

As a customer, you can:

• Export findings, scan data, and reports at any time (CSV, Excel, PDF)
• Remove ServiceNow connections, which immediately invalidates stored credentials
• Delete users and engagement data via the admin interface
• Request full data deletion. Submit a request via the Privacy Requests form (preferred, and handles GDPR / UK GDPR / CCPA access, deletion, correction, portability, and opt-out of sale / sharing) or by email to privacy@oryniq.com. All tenant data will be purged within 30 days of a verified deletion request.
• Review all platform activity via the audit log

To exercise any of the above rights as a data subject (not just a customer), use the Privacy Requests form. We respond to verified requests within 30 days.

9b. EU/UK Representative and Right to Complain

OrynIQ has no establishment in the EU or UK. Under Article 27 GDPR and the equivalent UK GDPR provision, OrynIQ has appointed GDPRLocal as its representative:

• EU representative: Instant EU GDPR Representative Ltd — Adam Brogden, contact@gdprlocal.com — Office 2, 12A Lower Main Street, Lucan, Co. Dublin, K78 X5P8, Ireland.
• UK representative: GDPRLocal Ltd. — Adam Brogden, contact@gdprlocal.com — 1st Floor Front Suite, 27–29 North Street, Brighton, England, BN1 1EB.

You may direct GDPR/UK GDPR inquiries to the appropriate representative above, or to OrynIQ directly at privacy@oryniq.com.

Right to lodge a complaint. If you are a data subject in the EU or UK, you have the right to lodge a complaint with your local supervisory authority at any time — most directly the Irish Data Protection Commission (EU) or the UK Information Commissioner's Office (UK), or the supervisory authority of your own habitual residence, place of work, or place of the alleged infringement. This right exists independently of, and is not limited by, any point of contact named on this page.

10. Compliance Posture

OrynIQ is designed for deployment in regulated environments including financial services. Customers in regulated industries are encouraged to contact us to review specific control requirements.

10a. Canadian Customers

OrynIQ processes personal information of Canadian individuals in alignment with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial equivalents, including Quebec Law 25, Alberta PIPA, and British Columbia PIPA.

Cross-border transfers. Customer data is hosted on Microsoft Azure infrastructure in the East US region (United States). Processing by sub-processors (Microsoft Azure, Anthropic, Stripe, Resend, Cloudflare, PostHog) also occurs in the United States. OrynIQ remains contractually accountable for personal data transferred to sub-processors and binds each sub-processor to comparable protection via the Data Processing Agreement.

Controllers subject to Quebec Law 25 are responsible for any privacy impact assessment that may be required prior to cross-border transfer. OrynIQ will provide reasonable information to support that assessment on request. Contact privacy@oryniq.com.

11. What We Don't Do

• We do not sell or share your data with third parties for any purpose other than service delivery
• We do not use your ServiceNow data to train AI models
• We do not send bulk marketing emails or run automated outreach campaigns. As a small startup, the OrynIQ founder may occasionally reach out personally (typically via LinkedIn) to recent self-serve signups (AI Readiness, 30-day Trial, Foundation) asking for product feedback, including when a free trial hasn't been activated after a week or so. These messages are 1:1, not automated, and you can ask us to stop at any time by replying or emailing privacy@oryniq.com.
• We do not store plaintext credentials at any point
• We do not make changes to your ServiceNow instance without explicit human approval

12. Contact