Aegis — Privacy Policy

Provider: Backbone Business Solutions Inc., trading as Backbone Solutions ("Backbone", "we", "us") Service: Aegis automated security testing platform ("Aegis", "the Service") Effective date: 18 August 2026 · Version: 1.0

This policy is provided in good faith to explain how the Aegis service handles personal data. It is not legal advice. You should have your own qualified counsel review how this policy applies to your circumstances, and Backbone recommends the same for itself.

---

1. Who we are and what this policy covers

Backbone Business Solutions Inc. ("Backbone"), incorporated in British Columbia, Canada (incorporation number BC1601923), operates Aegis, a self-serve automated penetration-testing and dynamic application security testing (DAST) service available at aegisbackbone.com.

This policy explains what personal data we collect through the Aegis service, why we collect it, how we use and share it, and the rights you have. It is governed by the laws of British Columbia and Canada, and reflects our obligations under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (BC PIPA).

For personal data you handle as a customer — that is, information about your own systems, users and data discovered while you run tests against targets you control — you are the organisation that decides how that data is used (the "controller"), and Backbone acts as your service provider (a "processor") in respect of it. See section 10.

2. What we collect

We collect only what we need to provide the Service:

• Account data. Your name and a work email address. Consumer email domains (for example free webmail providers) are rejected at sign-up; an account must be tied to an organisation.
• Authentication and MFA data. Login credentials (stored only as salted hashes) and multi-factor authentication enrolment data.
• Tenant / organisation information. Your organisation name and workspace configuration.
• Scan targets and configuration. The domains, hosts and assets you nominate, the tier you select, and the scan settings you enter.
• Credentials you supply for authenticated testing. Where you configure authenticated or aggressive tests, the credentials you provide for the Service to sign in to your target. These are stored encrypted.
• Scan findings and reports. The results of the tests you initiate, including evidence captured during testing (redacted server-side before storage).
• Usage and telemetry. Logs of your interactions with the Service, such as sign-ins, scans initiated, timestamps, IP address and browser/user-agent, used for security, troubleshooting and service operation.
• Billing data. Your subscription and payment status. Payments are processed by Stripe; we do not store full card numbers.
• Support communications. Messages you send us and our replies.
• Cookies and local storage. A session token and other strictly essential items. The site uses minimal, essential cookies only (see section 12).

3. How and why we use it

We use personal data to:

• provide, operate and maintain the Service;
• run the scans you initiate against targets you have verified you control;
• authenticate you and secure your account (including MFA);
• process billing and manage your subscription;
• provide support and respond to your enquiries;
• protect the Service — detecting, preventing and investigating abuse, unauthorised testing, fraud and security incidents;
• comply with our legal obligations; and
• improve the Service, using aggregated and anonymised data that does not identify you or your systems.

4. Legal bases

Where a legal basis is required, we rely on:

• Performance of a contract — to deliver the Service you have signed up for;
• Legitimate interests — to secure, operate, troubleshoot and improve the Service, and to prevent abuse, balanced against your rights;
• Consent — where we ask for it (you may withdraw consent at any time; withdrawal does not affect processing already carried out); and
• Legal obligation — where the law requires us to process or retain data.

Under PIPEDA and BC PIPA, we collect, use and disclose personal information only for purposes a reasonable person would consider appropriate in the circumstances, and with consent except where the law permits otherwise.

5. Sub-processors and third parties we share with

We share personal data only as needed to run the Service, and only with sub-processors bound by contract to protect it. We do not sell personal data.

We may also disclose data where required by law, to enforce our agreements, or to protect the rights, safety and property of Backbone, our customers or the public. A current list of sub-processors is available on request.

6. Data residency and international transfer

The Service runs on hosted infrastructure provided by the sub-processors named above, and personal data may be processed and stored in data centres located outside British Columbia, including outside Canada. Where personal data is transferred across borders, we rely on our contracts with sub-processors and appropriate contractual protections (such as standard contractual clauses) to keep it protected to a comparable standard. While data is held by a service provider in another jurisdiction, it may be subject to the laws of that jurisdiction.

7. Retention

While your account is active, scan reports and findings are retained for up to 18 months so you have a running security history for auditors (consistent with our Terms of Service). You may export or delete your data at any time.

On termination, we delete or return your data within 30 days, except for backups purged on their ordinary cycle and records we are required to retain by law. Account and billing records may be retained as long as necessary to meet legal, tax and accounting obligations.

8. Security measures

We protect personal data with measures including:

• Encryption in transit and at rest, including encryption of credentials you supply for authenticated testing;
• Tenant isolation, so each workspace's data is scoped to that workspace;
• Server-side redaction of evidence before findings are stored;
• Access controls limiting staff access to what is necessary; and
• Multi-factor authentication for account access.

No method of transmission or storage is perfectly secure, but we work to protect personal data appropriately to its sensitivity.

9. Your rights

Under PIPEDA and BC PIPA you have the right to:

• access the personal data we hold about you;
• correct inaccurate or incomplete personal data;
• delete your data (subject to our lawful retention obligations);
• export / port your data in a usable format;
• withdraw consent to processing that relies on consent; and
• complain to a regulator.

To exercise any of these rights, contact us at aegis.support@backbonesolutions.ca. We will respond within the timeframes required by law. You may also export and delete much of your data directly from your account. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada or, in British Columbia, the Office of the Information and Privacy Commissioner for BC (BC OIPC).

10. Customer targets and findings

When you run tests, the Service may collect information about your own systems, applications and users — for example account data uncovered during authenticated testing, or evidence captured in findings. That data relates to your environment and your users, and you control it: you decide the targets, scope and purpose. In respect of that data, Backbone acts as your processor / service provider, handling it on your instructions and only to deliver the Service.

You are responsible for having a lawful basis to test your targets and to process any personal data of your users that testing may reveal, and for meeting your own obligations to those users. A Data Processing Agreement is available on request.

11. Children

The Service is a business tool. It is not directed to individuals under 16, is not intended for use by consumers or children, and we do not knowingly collect personal data from anyone under 16. Accounts must be tied to an organisation and a work email address.

12. Cookies

The site and Service use strictly essential cookies and local storage only — principally a session token to keep you signed in and to secure your session. We do not use third-party advertising cookies or cross-site ad tracking. Because these items are essential to the Service, they are not used for profiling or marketing.

13. Changes to this policy

We may update this policy from time to time. If we make a material change, we will provide notice — for example by email or a notice within the Service — before it takes effect. The "Effective date" above indicates when this version took effect. Continued use of the Service after a change takes effect constitutes acceptance of the updated policy.

14. Contact

Questions, requests or complaints about privacy: aegis.support@backbonesolutions.ca · Backbone Business Solutions Inc., incorporated in British Columbia, Canada (incorporation number BC1601923), operator of the Aegis service.