How Aevum Security collects, uses, stores and protects personal data, in accordance with Singapore's Personal Data Protection Act 2012.
This policy is issued by Aevum Security Pte. Ltd. ("Aevum Security", "we", "us"), a company incorporated in Singapore. It covers personal data we collect through aevumsecurity.com.sg, its agent surface at agents.aevumsecurity.com.sg, and direct correspondence with us.
It does not cover personal data we process on behalf of a client under a services agreement. In those engagements the client is the data controller and the relevant data protection agreement governs, not this page.
We collect only what the form asks for, plus the minimum technical context needed to operate it safely:
We do not ask for, and you should not send us, government identifiers, financial account details, health information, or any sensitive personal data through this form.
Our agent interface exposes a submit_enquiry action. When an agent calls it, the same fields above are recorded, together with the identity of the agent key used and a cryptographically signed receipt of the transaction. An agent should only call it with your consent; if you believe an agent submitted an enquiry without your authority, tell us and we will delete it.
The read-only agent tools (list_services, get_service_details) collect no personal data. They return our own published service catalogue.
This website sets no advertising cookies, no analytics cookies and no tracking pixels. Our content delivery and bot-protection provider, Cloudflare, may set strictly necessary cookies to operate its security services and records standard request logs (IP address, timestamp, requested URL, user-agent) for that purpose.
We do not use your personal data to train machine-learning models, we do not sell it, and we do not send marketing to anyone who has not asked for it.
We share personal data only with the service providers needed to run this website and reach you, and only to the extent they need it:
| Provider | Why |
|---|---|
| Cloudflare | Content delivery, TLS termination, DDoS protection, and the Turnstile challenge that keeps bots out of the contact form |
| Microsoft (Microsoft 365 / Graph) | Delivering the notification email to us and the acknowledgement email to you |
| Telegram | An internal operational alert that an enquiry has arrived (message content is included so we can triage promptly) |
We may also disclose personal data where we are required to by law, by a court, or by a regulator with jurisdiction over us, and to our professional advisers where necessary.
We do not sell, rent, or trade personal data with anyone, for any purpose.
Enquiry records are stored in an encrypted-at-rest database on infrastructure we operate ourselves in Singapore. Email and alerting providers named above process data on their own global infrastructure, which may involve transfers outside Singapore; where that happens we rely on those providers' contractual data protection commitments, consistent with the PDPA's transfer limitation obligation.
We keep enquiry records for as long as needed for the purpose they were collected for, and then for as long as we are required to retain business records — as a rule, up to 24 months from your last contact with us, unless a longer period is required by law or by an ongoing engagement. After that they are deleted.
We are a cybersecurity firm and hold ourselves to the controls we recommend to clients. In particular: TLS in transit throughout, encryption at rest, least-privilege access with access limited to the personnel who need it, network-level isolation of the database from the public internet, rate limiting and bot verification on every submission path, structured audit logging, and a documented patching and vulnerability-management process.
No control set is absolute. If a data breach occurs that is likely to result in significant harm or is of a significant scale, we will notify the Personal Data Protection Commission and affected individuals as required by Part 6A of the PDPA.
Under the PDPA you may:
Write to [email protected]. We will acknowledge within 5 business days and respond substantively within 30 days; if we need longer, we will tell you why and when.
If you are not satisfied with our response, you may lodge a complaint with Singapore's Personal Data Protection Commission.
Our Data Protection Officer can be reached at [email protected]. Please mark your message "DPO — PDPA request" so it is routed correctly.
We will update this page when our practices change, and revise the "last updated" date above. Material changes affecting how we use data you have already given us will be notified to you directly where we hold your contact details.