Privacy Policy

Bowshock is a product of StrataSpace, Inc. (“StrataSpace,” “we,” “us”). This policy explains what we collect through Bowshock, how we use it, who we share it with and the choices you have. It covers the website at bowshock.space, the waiting list, the Bowshock dashboard and service, and the alerts Bowshock sends by email, Slack and text message (together, the “Service”).

1. Who this policy covers

Bowshock deals with four groups of people, and our role is different for each.

• Visitors to bowshock.space. We decide how this information is used.
• People who join the waiting list. We decide how this information is used.
• Customer staff: people at a company that uses Bowshock who sign in to the dashboard or receive its alerts. The company (our “customer”) controls its account, and we process its staff’s information on its behalf. If you are one of these people, please send privacy requests to your company first.
• People whose details appear in security evidence: the users of a customer’s app, and the people and machines that attack it. The customer decides what its app sends us, and we process it on the customer’s behalf under our agreement with them. The exception is attack indicators, which we also use to protect other customers, as section 5 explains.

2. What we collect

Website visitors. Our website sets no cookies and loads no third-party scripts or fonts. When you visit, the page reports that it was viewed, which sections you scrolled to, how far you got with the sign-up form (never what you type), the size class of your screen, whether you are on a phone or a computer, your country (from our content delivery network), the site or campaign that sent you, and a visitor code. The visitor code is a hash of your network address and browser made with a key that changes every day, so we can count visits within a day without recognizing you on another day. We do not store your network address with these records. If your browser sends a Global Privacy Control or Do Not Track signal, the page reports nothing. Our hosting provider uses your network address to deliver the page, and we use it briefly to limit abusive traffic.

The waiting list. Your email address and the technology stack you pick. If you choose to give them, we also collect your framework, where your app runs, your company, your app’s address and what you have seen probing your app, plus the site or campaign that sent you. Before we store what you write about attacks you have seen, we remove network addresses and long tokens from it. We never visit the app address you give us.

Customer staff. Your email address, name and role, your sign-in and session records, and a record of every change you make in the dashboard. If you choose, we also collect a mobile number for text alerts (section 3) and the link between your Bowshock account and your Slack account.

Security evidence. A customer adds our software to its app and grants Bowshock access roles in its cloud account. Through these we receive security events about the customer’s app: request details such as network addresses, user agents and paths, the account identifiers and email addresses of the app’s users involved in an event, and alarms and findings from the customer’s cloud provider. Our software removes passwords, tokens, keys and cookies before evidence leaves the customer’s app, and our servers check again for recognizable secrets when evidence arrives.

Messages to us. When you email us or book a call, we keep what you send.

3. Text messages

Customer staff can choose to receive security alerts by text message. To opt in, you add your own mobile number in Bowshock’s notification settings, agree to receive texts, and enter the six-digit code we text to it. We keep your number, whether it is verified, your place in your team’s text order, the delivery status of each text and whether you have opted out. We use your number only to send the alerts and codes described in our Terms of Service and to protect the Service from abuse.

Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. Our text message provider, Amazon Web Services, receives your number and each message to deliver it, handles opt-outs and tells us whether each text was delivered.

Reply STOP to any text to stop receiving them. To receive them again, reply START and then verify your number again in Bowshock. Reply HELP for help, or email support@strata.space.

4. How we use information

We use information to:

• run the Service: detect and investigate attacks on a customer’s app, take the actions the customer has authorized, and tell the customer’s staff what happened
• sign people in, keep accounts secure and keep a record of every change and every action Bowshock takes
• send alerts and summaries by email, Slack or text message, following your organization’s settings and your own choices
• contact people on the waiting list about early access
• count visits to our website and see which pages work
• improve how Bowshock detects and decides, for each customer and, as section 5 explains, for all customers
• prevent fraud and abuse, enforce our terms and meet legal obligations

We do not sell personal information, and we do not use it for advertising.

5. Attack indicators and what we learn across customers

Attack indicators, such as the network addresses, networks and techniques used in attacks against our customers, help us protect every customer. We use them, together with statistics about which of Bowshock’s decisions turned out right or wrong, to improve detection for all customers. When we combine decision outcomes across customers, each pattern draws on at least five customers, and we never tell one customer what another saw or anything about another customer’s users.

For attack indicators we act as an independent controller, on the basis of our legitimate interest in keeping networks and information secure.

6. AI and automated decisions

Bowshock uses AI models to investigate security events and decide how to respond. We run models through Amazon Bedrock, and in some cases through Anthropic directly. These providers receive only what a decision needs, and their terms do not allow them to train their models on it. Some routine decisions use TypeSafe’s Jev service, which receives categories of events and our own rules, never names, addresses or other identifiers. We do not use customer data to train general-purpose AI models.

Depending on the settings a customer chooses, Bowshock can act on its own, for example by blocking a network address or disabling a user account in the customer’s app. If you believe Bowshock acted against you by mistake, contact the company that runs the app. Its staff can see every action Bowshock takes and reverse most of them. Ending a user’s sessions cannot be undone.

7. Who we share information with

The customer. A customer’s staff can see the security evidence for its app, its people and the record of every change and action in its account.

Service providers. We use these providers to run the Service:

• Amazon Web Services: hosting, storage, encryption keys, email delivery, text message delivery and AI models through Amazon Bedrock, in United States regions
• Neon: our database
• TypeSafe: the Jev decision service, which receives no identifiers
• Anthropic: AI models, when we use them directly
• Slack: alerts and approvals, only for customers who connect a Slack workspace

We update this list before a new provider receives personal information. If you book a call with us, the booking is handled by Cal.com under its own privacy policy.

For legal reasons. We may disclose information when we reasonably believe it is necessary to comply with a law, legal process or government request, to enforce our terms, or to protect the rights, property or safety of StrataSpace, our customers or the public.

Business transfers. If we are involved in a merger, acquisition or sale of assets, information may be transferred as part of that transaction, under ordinary confidentiality protections.

We do not sell personal information, and we do not share it for cross-context behavioral advertising as U.S. state privacy laws define those terms.

8. Cookies

Our website sets no cookies. The Bowshock dashboard uses only cookies that are strictly necessary to keep you signed in and to protect your requests. We use no analytics or advertising cookies.

9. How long we keep information

• Website visit records: they expire after 90 days and are then deleted automatically. The daily key behind the visitor code expires after 48 hours.
• Requests caught by our anti-spam check: they expire after 30 days.
• Waiting list entries: no fixed period. We remove yours when you ask.
• Network addresses, email addresses and account identifiers in security evidence: up to 365 days, and longer only while an action still in force or a target the customer has protected depends on them. After that, incident history keeps only a keyed hash of each value, so past incidents still make sense without the original.
• Firewall and network logs of our own systems, which record the addresses that reach them: up to 365 days.
• Audit records of changes and actions in Bowshock: 400 days.
• Mobile numbers: until you remove yours or leave your team in Bowshock. Records of the texts sent to a number are kept for 365 days, and audit records that name it for 400 days.
• Account information: while the customer’s account is open. When an account closes, the periods above still apply to what remains, and we delete it when they end unless the law requires us to keep it.

10. Security

We protect information with encryption at rest, encrypted connections between the internet and our service, least-privilege access, short-lived credentials for our own staff, and an audit record of every action Bowshock takes. No system is perfectly secure. If you find a vulnerability, please report it to security@strata.space.

11. Where information is processed

StrataSpace is based in the United States, and the Service runs in Amazon Web Services data centers in the United States. If you use the Service from outside the United States, your information will be transferred to and processed there. If your organization needs a data transfer agreement, email privacy@strata.space.

12. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict some processing, and to withdraw consent. To use these rights, email privacy@strata.space. If you are a customer’s staff member, or your details reached us in a customer’s security evidence, please contact that customer first. We will help it respond. We do not discriminate against anyone who uses these rights.

California residents. Section 2 describes the categories of personal information we collect. We do not sell personal information or share it for cross-context behavioral advertising. You may use an authorized agent to make a request for you.

Residents of the EEA, the UK and Switzerland. We rely on performance of a contract, our legitimate interests (including running and securing the Service and protecting our customers from attacks), compliance with legal obligations, and consent where we ask for it. You have the right to complain to your supervisory authority.

13. Children

The Service is for businesses and is not directed to children. We do not knowingly collect personal information from children under 13 (or the minimum age where you live). If you believe a child has given us personal information, email privacy@strata.space and we will delete it.

14. Other websites

The Service links to other websites, such as Cal.com for booking a call. Their own privacy policies apply there.

15. Changes to this policy

We may update this policy. When we make a material change, we will post the new version here, update the date at the top and, where the law requires, tell you by email or in the dashboard.

16. Contact

Questions about this policy or our privacy practices? Write to StrataSpace, Inc. at privacy@strata.space.