Privacy Policy

This policy explains what personal data CISO Tribune collects through CISO Tribune, why, and what your rights are. The short version: this is a publication, not a data business. We collect very little, and we do not sell personal data.

What we collect

Reading the Site: we do not require an account. Our hosting provider (Vercel) processes standard server logs — IP address, user agent, requested pages — to deliver the Site, for security, and for aggregate, non-identifying performance measurement. Log data is processed under the provider's own terms and retained per its policy. We also measure readership with Google Analytics: by default it runs without cookies or any identifier stored on your device and only receives anonymized, aggregate pings (page, country, device type, referrer); if you accept on the cookie banner it may set its first-party analytics cookies. Advertising features and Google signals are switched off and IP addresses are anonymized. Google processes this data under its own terms.

Contacting us: if you email the desk, we receive your address and what you send. We use it to respond and to do journalism. Source communications are treated as confidential to the extent the law allows.

Newsletter: if you sign up, we pass your email address to our newsletter provider, Buttondown, which emails you to confirm the subscription and then sends each issue. Buttondown processes the address under its own terms. Every issue has an unsubscribe link, and unsubscribing stops all mail. We only email people who signed up themselves; we never add addresses from other sources.

Alerts: if you sign up for the weekly new-CISO alerts on New in seat, the sectors you pick are stored at Buttondown as tags on your subscriber record (for example "sector:healthcare") and used only to decide which weekly alert you receive. Signing up again adds sectors; it does not remove any. Every alert has an unsubscribe link, and unsubscribing stops all mail from us. The alerts list only what the public record pages already show.

Editorial subjects: The Wire records professional facts about named individuals — role, employer, appointment dates — drawn from public primary sources such as company announcements and regulatory filings. We process this information for journalistic purposes. If an entry about you is wrong, use the corrections process on our about page.

CISO Voices: CISO Voices records that people our record names as sitting security leaders spoke in public (a post on LinkedIn, X, Bluesky or Mastodon, a bylined article, a podcast, a talk or a video), with the date, the link and our own one-line description, and person pages link to the public profiles we matched to them by name and company. We do not copy or store what they wrote or said. We never log in to LinkedIn or X or fetch pages from them; posts there are found through public web search results or submitted by our editor. Bluesky and Mastodon posts come from their public APIs, and on Mastodon only from accounts that opted in to being discoverable. Lines marked "Our take" (and "What we've noticed" on person pages) are our editors' opinion on the topics people raise, written from the text we can see (for LinkedIn, the public search excerpt) and from our own record; they are not their words, and we do not store the text they were written from. Anyone can ask for a correction or removal through our corrections process. Conference talks and podcast episodes also come from the events' own agenda pages and the shows' own public feeds (the speaking circuit, podcast episodes); an upcoming session is listed only from the event's own agenda and says so. Readers' data: an embedded LinkedIn post loads from LinkedIn, which then processes your data under its own policy (and the same for an embedded X post), only if you click "Show post" or turn on "Show posts inline"; see the cookie policy. If an entry about you is wrong, use the corrections process on our about page.

Vendor claims and corrections: a company claims its vendor directory entry by publishing a small text file on its own website naming the company and, if it chooses, a contact address and a briefing opt-in. We read that file once a day with one plain request. The address is used only to reach the company about its entry; if the file opts in, we pass it to Buttondown, which asks the address to confirm, and nothing is sent until it does (unsubscribing stops all mail). Nothing from the file enters the published record or our repository beyond the date and the proof method. People with access to our GitHub repository can claim or suggest a correction through issue forms there instead (hosted by GitHub, under its own terms), holding the name, role and work email they give; none of it is published. How it works: for vendors.

What we don't do

No sale of personal data. No advertising trackers. No profiling. Analytics cookies are set only if you accept them on the cookie banner; you can change that choice any time on thecookie policy page.

Legal bases (GDPR)

Where EU/UK data-protection law applies: we process server logs under legitimate interest (running and securing the Site); correspondence under legitimate interest (responding, reporting); newsletter subscriptions under your consent, which you can withdraw at any time by unsubscribing; and editorial content under the journalism provisions of applicable law.

Your rights

Depending on where you live, you may have rights to access, correct, delete, or object to processing of your personal data (GDPR, UK GDPR, CCPA/CPRA, and similar laws). Write to editorial@cisotribune.com and we will respond within the timeline the applicable law requires. Journalistic processing may be exempt from some requests; where it is, we will say so.

Data transfers & retention

The Site is hosted on global infrastructure, so data may be processed outside your country. We keep correspondence as long as needed for the purpose it was sent, and published editorial content indefinitely as part of the public record.

Children

The Site is not directed to children under 16 and we do not knowingly collect their data.

Changes & contact

We will update this policy when our practices change, and the date above will reflect it. Privacy questions: editorial@cisotribune.com.