Privacy Policy

Indurevia provides operational technology (OT) cybersecurity readiness and risk-screening services for manufacturing and industrial organizations. This Privacy Policy explains how information is collected, used, stored, retained, and shared when you use the Indurevia website, OT Cyber Risk Assessment, paid assessment products, reports, and related services.

1. Information We Collect

When you use the Indurevia OT Cyber Risk Assessment, Indurevia may collect and store your responses to assessment questions, selected maturity scores, explanations provided when a control is marked Not Applicable, calculated scores, findings, and information used to generate assessment results and reports.

Depending on the features or services you use, we may also collect information you voluntarily provide, such as your name, email address, organization name, industry, organization size, and information submitted through a contact form or other communication with Indurevia.

When you purchase a paid service, Indurevia may receive and store transaction-related information such as your name, email address, order information, payment status, and identifiers associated with the payment transaction.

Indurevia uses website analytics services, including Vercel Web Analytics and Google Analytics 4, to understand website visits, referring sources, browser and device information, approximate geographic information, and interactions with Indurevia services. This information helps evaluate website performance, understand engagement, and improve the service.

1A. Google Analytics and Conversion Measurement

Google Analytics 4 may collect information about visits to the Indurevia website, including page views, approximate location derived from network information, device and browser details, referring sites, and engagement activity. Google Analytics may use cookies or similar browser technologies and process online identifiers in accordance with Google's policies.

Indurevia also measures selected interactions, including when someone begins or finishes the free assessment, clicks to open a Guided Assessment inquiry email, or reaches a Starter Assessment payment-confirmation page after a paid order has been verified. Opening an inquiry email does not establish that the email was sent or a service was purchased.

These conversion events are designed not to include assessment responses, risk scores, names, email addresses, or payment identifiers in the event payload. Google Analytics may nevertheless process technical and usage information collected by the Google tag. Payment and order records remain in Indurevia's service systems rather than being sent as individual transaction identifiers in these custom events.

Indurevia asks for your consent before loading optional Google Analytics and Vercel Analytics scripts. You can accept or decline optional analytics in the website's privacy banner. Your preference is saved in your browser and may be changed later using the Privacy settings control. Declining optional analytics does not prevent you from completing the Indurevia assessment. Browser privacy controls may provide additional ways to limit tracking. Contact support@indurevia.com with questions about these practices.

2. Payment Information

Payment transactions are processed by Stripe. Payment-card information submitted through Stripe Checkout is processed by Stripe and is not intended to be stored directly by Indurevia.

Indurevia may retain payment-related identifiers, order status, purchase information, and other records reasonably necessary to fulfill purchases, provide customer support, maintain business records, prevent fraud, and address payment disputes.

3. Information You Should Not Submit

The Indurevia OT Cyber Risk Assessment is designed to evaluate cybersecurity practices without requiring sensitive technical information about your OT environment.

Please do not submit IP addresses, hostnames, usernames or passwords, equipment identifiers, firewall configurations, network diagrams, credentials, security keys, production configurations, or other sensitive operational or security information unless Indurevia specifically requests such information through an appropriate service and handling process.

4. How We Use Information

Information collected through the service may be used to calculate readiness scores, identify potential cybersecurity risk conditions, generate and maintain assessment results and reports, fulfill purchases, deliver paid reports, provide customer support, troubleshoot and secure the service, maintain business records, and improve the assessment methodology and related Indurevia services.

Indurevia does not use assessment responses to perform active scanning, penetration testing, or direct interaction with your OT systems.

5. Email and Service Communications

If you purchase a report or provide an email address for a service-related purpose, Indurevia may use that email address to deliver your report, provide access information, respond to support requests, or send other communications necessary to provide the service you requested.

Purchasing an Indurevia product does not automatically enroll you in marketing email communications.

6. Secure Report Access

Indurevia may generate a secure access credential for paid reports. Indurevia stores a derived cryptographic value associated with the report-access credential rather than the report-access token itself.

Secure report links may provide access to assessment information. You should therefore safeguard those links and share them only with authorized recipients.

7. Browser Storage

The assessment may use your browser's local storage to save assessment progress and related information while you complete the assessment. This allows responses to remain available if you refresh the page or return to the assessment using the same browser. Session storage may also be used to avoid counting repeat conversion events within a browser session. Google Analytics may use cookies or similar technologies for website measurement.

Information stored locally in your browser may remain until it is cleared by the application, by you, or by your browser.

8. Server-Side Storage

Assessment, order, and related service information may be stored in Indurevia's database infrastructure so that assessment results can be generated, maintained, delivered, and supported.

Indurevia uses third-party cloud and technology providers to operate portions of the service. These providers process information as necessary to provide their services to Indurevia.

9. Data Retention

Incomplete free assessments are generally retained for up to 30 days from creation. Completed free assessments are generally retained for up to 12 months from creation. Assessment responses and Not Applicable justifications associated with an assessment follow the retention period applicable to that assessment.

Starter Assessment data and associated report information may be retained for up to 12 months after purchase to provide report access and reasonable customer support.

Guided Assessment records, including working assessment data, final report information, evidence-register entries, and any supporting artifacts Indurevia retains for the engagement, may be retained for up to 12 months after report delivery to provide reasonable customer support, clarification, and reassessment context. Indurevia may delete retained customer-provided supporting artifacts sooner when they are no longer needed, and evidence reviewed live without retention is not stored by Indurevia.

Certain transaction, payment, accounting, fraud-prevention, dispute, and other business records may be retained for longer when reasonably necessary for legitimate business purposes or to satisfy applicable legal, tax, accounting, or regulatory obligations.

Indurevia may use automated database processes to identify and remove assessment information that has exceeded applicable retention periods.

10. Anonymous Assessments and Privacy Requests

The free assessment may be completed without creating a user account. As a result, Indurevia may not have enough information to reliably associate an anonymous assessment with a particular individual or organization.

You may contact Indurevia to request access to, correction of, or deletion of identifiable information associated with you. Indurevia will make reasonable efforts to respond to valid requests when the information can be reliably identified and the requester's relationship to that information can be appropriately established, subject to information that must or may be retained for legitimate business or legal purposes.

11. Data Security

Indurevia uses reasonable administrative and technical measures intended to protect information handled through the service. However, no internet-based service, database, email system, or electronic storage system can be guaranteed to be completely secure.

12. Assessment Limitations

The Indurevia OT Cyber Risk Assessment is a cybersecurity readiness and risk-screening tool. Assessment results are based primarily on information provided by the organization and may not have been independently verified.

Assessment results do not constitute certification, regulatory compliance, a formal cybersecurity audit, penetration test, vulnerability assessment, or guarantee that an organization or system is secure.

13. Service Providers

Indurevia currently uses third-party providers including Vercel for application hosting and Web Analytics, Google for Google Analytics 4, Supabase for database infrastructure, Stripe for payment processing, and Resend for transactional email delivery. These providers may process information as necessary to provide their respective services to Indurevia.

Indurevia may change or add service providers as the service evolves. Service providers may maintain their own privacy, security, and data-processing practices.

14. Disclosure of Information

Indurevia may disclose information to service providers as necessary to operate and support the service. Information may also be disclosed when reasonably necessary to comply with applicable law, legal process, protect the rights or security of Indurevia or others, investigate misuse or fraud, or enforce applicable agreements.

Indurevia does not sell assessment responses or customer personal information.

15. Changes to This Policy

Indurevia may update this Privacy Policy as the service evolves. Material changes may be reflected by updating the effective date displayed on this page.

16. Contact

Questions about this Privacy Policy, privacy practices, or requests concerning identifiable information may be sent to:

Indurevia
support@indurevia.com