Privacy Policy

Who we are

• Brainkin Sdn Bhd (Registration No. 202601041233 (1703328-D)), a company incorporated in Malaysia. Contact for privacy questions and requests: Support in your Vantiqo workspace (or the platform console).
• For personal data inside a customer's workspace we act as the customer's processor (see the Data Processing Agreement); for our own customer, billing and website records we are the controller.

What we collect

• Account data: names and usernames, email addresses, phone numbers if given, roles, sign-in times, IP addresses and browsers, two-factor settings (we store passkeys' public keys and authenticator secrets encrypted; never your codes or biometrics).
• Service data from your estate: inventory and configuration of your cloud resources, costs, metrics, the logs you search, uptime results, findings, incidents, approvals and the audit trail of actions in your workspace.
• Server agent data: host name, operating system, CPU, memory, disk, network, uptime, the busiest processes' names, listening ports and the processes behind them, failed services, pending updates and the cloud instance identity. It doesn't read files, logs, user activity or data on the server.
• Credentials you store (cloud keys and tokens, integration tokens): encrypted with your workspace's own key; never shown again after you save them.
• Billing data: plan, usage counts, statements and invoices. Card details go directly to our payment provider; we don't see or store card numbers.
• Support data: tickets and messages you send us.

How we use it

To provide the service you configure (monitoring, alerts, reports, fixes, runbooks), keep it secure (sign-in protection, rate limits, audit logs, abuse prevention), bill for it, support you when you ask, and keep it reliable. We don't sell personal data or use service data for advertising, and we don't use it to train AI models.

Legal basis

Performing our contract with your organisation; our legitimate interests in securing and improving the service; and legal obligations (for example tax records). Where consent is needed (for example optional email notices), you can withdraw it at any time.

Where it's kept

• In managed databases and storage of our hosting providers (Amazon Web Services and MongoDB Atlas), encrypted in transit and at rest, in the data region of your workspace; platform records (accounts, billing) in our main region. Nightly encrypted backups are kept for about 35 days.
• Some sub-processors are outside your country; transfers are protected by the providers' contractual safeguards.

Who we share it with

The sub-processors listed on the Sub-processors page, only as needed for the service; the alerting and collaboration services you choose to connect (they receive the alerts you route to them); your partner, if one manages your workspace (the access you grant it); and authorities when the law requires.

Retention

• Account data: while the workspace exists. Sign-in records and audit trail: as long as the workspace exists, unless you archive or delete them.
• Service data has fixed retention, for example: server agent metrics 30 days, live view samples 10 minutes, raw uptime results 14 days, history up to 400 days, scan history 30 days.
• When a workspace is deleted, its data and its encryption key are deleted; backups expire within about 35 days.

Security

A separate database and encryption key per workspace, keys protected by AWS KMS, TLS everywhere, two-factor sign-in and passkeys, IP allowlists, least-privilege and guard-railed cloud access, audit logging, nightly encrypted backups with restore tests, and continuous monitoring of our own infrastructure (see our public status page).

Your rights

You can access, correct, export or delete your personal data — most of it directly in your workspace — or ask us via Support in your Vantiqo workspace (or the platform console); for data in a customer's workspace, ask that customer first. You may complain to your data protection authority (in Malaysia, the Personal Data Protection Commissioner).

Cookies

We use only the cookies needed to keep you signed in and secure; see the Cookie Notice.

Changes

We'll tell workspace administrators about material changes before they apply, and show the date of the latest version here.