Privacy Policy
Advisedly Compliance LLC — Last updated July 12, 2026
1. Introduction
Advisedly Compliance LLC ("Advisedly," "we," "us," or "our") operates the advisedly.ai compliance management platform. This Privacy Policy describes how we collect, use, disclose, and protect information when you use our platform, website, and services.
By accessing or using our services, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use our services.
2. Information We Collect
Account Information
Name, email address, company name, phone number, and job title provided during registration or lead capture.
Compliance Data
Vulnerability scans, STIG checklists, POA&M items, policies, evidence files, assessments, and other compliance artifacts you upload or create on the platform.
Usage & Technical Data
Pages visited, features used, session duration, IP address, browser type, and device information. We set first-party cookies for authentication and request-forgery protection only — no third-party tracking cookies.
Cookies & Browser Storage
The table below lists every cookie and browser storage key the Advisedly web application sets. There are no advertising or analytics cookies and no third-party cookies. We do not currently show a cookie consent banner or a cookie preference centre. Preference and convenience values stay in your browser and are not used for tracking; you can remove them at any time by clearing site data in your browser. Keys ending in a colon or underscore are completed with an organization, user or date suffix at runtime.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
| __Host-advisedly_token | Cookie | Authentication: access token (HttpOnly, SameSite=Strict, Secure). | Up to 1 hour; cleared at sign-out |
| __Secure-advisedly_refresh | Cookie | Authentication: refresh token, limited to /api/auth (HttpOnly, SameSite=Strict, Secure). | Up to 7 days; cleared at sign-out |
| __Host-advisedly_csrf | Cookie | Cross-site request forgery protection (readable by page scripts by design). | Up to 7 days; cleared at sign-out |
| advisedly_session | Cookie | Marker (value 1) that tells the app a sign-in exists; carries no credential. | 24 hours; cleared at sign-out |
| advisedly_sso_state | Cookie | Binds a single-sign-on attempt to this browser (HttpOnly, Secure, path /api/sso). | 10 minutes; cleared when the attempt completes |
| advisedly-theme | localStorage | Your light/dark/system theme choice. | Until you clear browser data |
| advisedly_device_fp | localStorage | Random per-browser identifier used by the approved-device sign-in check. | Until you clear browser data |
| advisedly_deployment_capabilities_v4 | localStorage | Short-lived cache of which features this deployment enables. | 5 minutes before refresh |
| advisedly_active_system_id: | localStorage | Last information system you selected, kept per organization. | Until you clear browser data |
| advisedly_active_system_id | localStorage | Legacy system selection key removed when loading a selection. | Removed when a system selection loads |
| advisedly_session_lock_test_override_ms | localStorage | Test-only session lock timeout override. | Until you clear browser data |
| advisedly_logout_pending | localStorage | Flag (value 1) that a sign-out is in progress so it completes even if the request is interrupted. | Removed once sign-out completes |
| advisedly_pinned_items | localStorage | Navigation items you pinned. | Until you clear browser data |
| advisedly_nav_active_section | localStorage | Which navigation section is expanded. | Until you clear browser data |
| advisedly_helper_pos | localStorage | Position of the helper chat button. | Until you clear browser data |
| rba-rank-mode: | localStorage | Your ranking preference (risk or exposure) on the risk-based alerting page, per user. | Until you clear browser data |
| vuln_mapper_target_frameworks | localStorage | Frameworks you selected in the vulnerability mapper. | Until you clear browser data |
| advisedly_first_run_banner_dismissed | localStorage | Remembers that you dismissed the first-run banner. | Until you clear browser data |
| advisedly_webauthn_soft_banner_dismissed | localStorage | Remembers that you dismissed the security-key enrollment banner. | Until you clear browser data |
| advisedly_demo_tour_checked | localStorage | Demo tour checklist progress (demo environments). | Until you clear browser data |
| advisedly_demo_tour_open | localStorage | Whether the demo tour drawer is open (demo environments). | Until you clear browser data |
| advisedly_demo_onboarding_v1 | localStorage | Demo onboarding progress (demo environments). | Until you clear browser data |
| advisedly_demo_onboarding_banner_dismissed | localStorage | Remembers that you dismissed the demo onboarding banner. | Until you clear browser data |
| advisedly_public_demo_onboarding_v1 | localStorage | Public demo onboarding progress. | Until you clear browser data |
| advisedly_session_locked | sessionStorage | Whether the idle session lock is engaged. | Until the tab closes |
| advisedly_sso_oidc | sessionStorage | Single-sign-on handshake values while you are redirected to your identity provider. | Until the tab closes; removed when sign-in completes |
| advisedly_post_login_next | sessionStorage | Same-site page to return to after sign-in. | Until the tab closes; removed after use |
| advisedly_nav_origin_ | sessionStorage | Same-site page to return to from a sub-page, per navigation context. | Until the tab closes |
| advisedly_helper_msgs | sessionStorage | Recent helper chat messages for the current organization, user and system. | Until the tab closes; messages older than 24 hours are discarded |
| advisedly_helper_msgs: | sessionStorage | Recent helper chat messages scoped to an organization, user and system. | Until the tab closes; messages older than 24 hours are discarded |
| advisedly:system-create-draft: | sessionStorage | Unsaved new-system form draft, per organization and user. | Until the tab closes; removed on restore or save |
| staleness_banner_dismissed_ | sessionStorage | Remembers that you dismissed the data-staleness banner for the current day. | Until the tab closes |
3. How We Use Information
- Service delivery: processing compliance data, generating AI-powered content, running scans, and producing reports.
- AI processing: compliance data is processed by a third-party AI service provider (selected at deployment time per your tenant's tier) when you use AI features. The selected provider does not use prompts or responses to train models, per their enterprise terms.
- Account management: authentication, authorization, and notifications.
- Product improvement: aggregated, anonymized usage metrics.
- Security: fraud prevention, access logging, and audit trails.
4. Data Sharing
We do not sell personal data. We share data only with sub-processors necessary to deliver our services (currently Microsoft Azure for hosting, infrastructure, encrypted automated database backups, and in-region point-in-time restore; Stripe for payment processing on SaaS subscriptions, and the AI service provider your organization selects at install time for AI processing), or when required by law.
Sub-processor list
Matches Appendix B of our Data Processing Agreement (effective July 12, 2026). The DPA governs notice of changes and your right to object.
| Sub-processor | Processing activities | Data location | Data categories processed |
|---|---|---|---|
| Microsoft Corporation (Azure) | Primary cloud hosting: Azure Container Apps, Azure Database for PostgreSQL Flexible Server, Azure Key Vault, Azure Container Registry, Azure Blob Storage, and managed PostgreSQL automated backups with in-region point-in-time restore | United States (East US 2 region) | All categories listed in Section 2.3 |
| AI service provider (selected by Controller at install time) | AI API processing for compliance gap analysis, control mapping, policy drafting assistance, and advisory features | Controller-determined per provider selected | Compliance assessments, policy documents, POA&M items, vulnerability scan summaries (transmitted only upon user-initiated AI action) |
| Stripe, Inc. | Payment processing for SaaS subscriptions (ACH-default invoicing); not used for on-prem / air-gap deployments | United States | Billing contact information, invoice line items |
| Planned sub-processor | Planned processing activities | Data location | Status |
|---|---|---|---|
| Microsoft Azure Government (Microsoft Corporation) | Cloud infrastructure planned for federal / DoD client workloads; authorization scope requires review before use | United States (Government Region) | Planned — subject to Sub-processor notification process |
| AWS GovCloud (Amazon Web Services Inc.) | Cloud infrastructure planned for federal / DoD client workloads; authorization scope requires review before use | United States (GovCloud Region) | Planned — subject to Sub-processor notification process |
5. Data Retention
Account and compliance data is retained during your active subscription plus a 60-day export window after cancellation. After this period, active systems data is destroyed within 30 days and encrypted backups within 90 days. AI interaction logs are automatically purged after 90 days. Lead capture data is retained for up to 2 years or until you request deletion.
6. Data Security
We protect data with encryption in transit (TLS 1.2+), refresh-token rotation for sessions, role-based access control, and regular security assessments. The platform encrypts stored secrets and credentials at the application layer with AES-256-GCM; other stored data relies on the storage encryption provided by the cloud provider or the infrastructure where the service runs.
Where data is stored: the hosted Advisedly SaaS service stores customer data in United States cloud regions (Microsoft Azure commercial regions, as recorded in our data-residency register dated 2026-08-19). Customer-hosted deployments store data where the customer hosts them, and Advisedly does not receive a copy unless the customer configures an outbound connector. Data sent to a customer-selected AI provider is processed under that provider's own terms and location.
7. Your Rights
You have the right to:
- Access, correct, or delete your personal data
- Export your data in standard formats (JSON, CSV, PDF)
- Opt out of AI processing features
- Restrict processing of your data
To exercise these rights, contact us at privacy@advisedly.ai. We respond within 30 days.
8. Changes to This Policy
We may update this policy with 30 days' notice via email or platform notification. Continued use after changes constitutes acceptance.
9. Contact Us
Advisedly Compliance LLC
1309 Case Rd, Prospect, TN 38477
privacy@advisedly.ai