We are committed to protecting your privacy and safeguarding your personal information.
Blacklock Security Limited
Blacklock Security Limited ("Blacklock", "we", "us" or "our") respects your privacy and is committed to protecting personal information and Customer Data entrusted to us.
This Privacy Policy explains how we collect, use, store, disclose and protect personal information when you:
• visit blacklock.io or another website operated by Blacklock;
• create or use a Blacklock account;
• use the Blacklock platform, software or cybersecurity services;
• participate in penetration testing, vulnerability scanning or other authorised security assessments;
• connect third-party services or integrations to Blacklock;
• request a demonstration, trial or support;
• attend an event or communicate with us;
• engage with us as a customer, prospective customer, partner, reseller, supplier or other business contact.
This Privacy Policy applies alongside Blacklock's Terms of Use, applicable Orders, Statements of Work, Software Licence and SLA and other written agreements.
Where there is a conflict between this Privacy Policy and a separately executed agreement governing the processing of Customer Data, the separately executed agreement will apply to the extent of that conflict.
Blacklock processes personal information in accordance with applicable privacy and data protection laws, including the New Zealand Privacy Act 2020.
For this Privacy Policy:
Customer means an organisation or person purchasing, subscribing to or authorised to use Blacklock Services.
Customer Data means information, files, targets, source code, configurations, scan data, security findings, reports or other information submitted to, generated through or processed using the Services on behalf of a Customer.
Personal Information means information about an identifiable individual.
Services means Blacklock's websites, SaaS platform, cybersecurity products, scanning services, software and associated functionality.
User means an individual authorised by a Customer to access or use the Services.
Depending on our relationship with you, Blacklock may process Personal Information for its own business purposes or on behalf of a Customer.
Blacklock acting for its own purposes
Blacklock determines how and why information is processed when we manage activities such as:
• user and account administration;
• customer relationships;
• billing;
• support;
• events;
• security;
• supplier relationships; and
• legal and regulatory compliance.
Blacklock processing Customer Data
When a Customer submits systems, applications, source code, repositories, targets or other information to Blacklock for cybersecurity services, Blacklock processes Customer Data to provide the Services requested by that Customer.
Customers are responsible for ensuring they have the necessary rights, permissions, authorisations and lawful basis to provide Customer Data to Blacklock.
Where Personal Information relates to an individual associated with one of our Customers, the relevant Customer may be primarily responsible for responding to requests concerning that information.
The information we collect depends on how you interact with Blacklock and the Services you use.
4.1 Contact and account information
We may collect:
• first and last name;
• business email address;
• telephone number;
• organisation name;
• organisation address;
• job title or role;
• country or region;
• account information;
• authentication and security information;
• account roles and permissions; and
• communications with Blacklock.
4.2 Commercial information
We may process information associated with:
• Orders;
• subscriptions;
• quotations;
• Statements of Work;
• invoices;
• billing;
• payment status;
• contracts; and
• reseller or partner relationships.
Blacklock does not store any payment card information. All payment processing is handled by Stripe.
4.3 Platform and security information
When you use the Blacklock platform, we may process:
• account activity;
• login events;
• IP addresses;
• user roles and permissions;
• IP whitelisting information;
• audit logs;
• feature usage;
• security events;
• integration activity;
• diagnostic information; and
• support information.
4.4 Cybersecurity and assessment information
Our Services may process technical information relating to authorised Customer assets, including:
• domains and subdomains;
• IP addresses and network ranges;
• hostnames;
• URLs;
• websites and APIs;
• application information;
• mobile applications;
• cloud environments;
• infrastructure information;
• source-code repositories;
• software dependencies;
• software versions;
• configurations;
• ports and services;
• vulnerability information;
• penetration-testing findings;
• vulnerability evidence;
• screenshots;
• validation commands;
• proof-of-concept information;
• risk ratings;
• remediation information;
• SAST findings;
• SBOM information;
• attack-path information; and
• penetration-testing and security-assessment reports.
Testing may incidentally encounter Personal Information contained within authorised Customer systems.
Where this occurs, Blacklock will process that information only to the extent reasonably necessary to provide the authorised Services, support a security finding, meet contractual requirements or comply with applicable law.
Blacklock does not intentionally seek access to Personal Information that is unnecessary for an authorised security assessment.
Customers may choose to connect Blacklock with third-party services.
Blacklock currently supports integrations including:
• Alerting: Slack and Microsoft Teams;
• Code repositories: GitHub, GitLab, Bitbucket and Azure DevOps;
• Ticketing and workflow: JIRA, Zapier and Vanta;
• Developer learning: Secure Code Warrior;
• Dark web monitoring: nWebbed; and
• Identity and Single Sign-On: Okta, Salesforce, JumpCloud and Microsoft Entra SAML SSO.
The information processed depends on the integration enabled and may include:
• account identifiers;
• repository information;
• projects;
• vulnerabilities;
• security findings;
• tickets;
• software dependencies;
• user identifiers;
• authentication events; and
• information necessary to perform the requested integration.
Blacklock does not store third-party or integration customer credentials in its systems.
Authentication instead use tokens, delegated permissions, secure authentication mechanisms or other methods provided by the relevant service.
Customers control which integrations they enable and are responsible for maintaining appropriate access permissions with third-party providers.
Third-party services may separately process information under their own privacy policies and terms.
When you visit our websites or use our Services, we may automatically collect information such as:
• IP address;
• browser type and version;
• device information;
• operating system;
• approximate geographic region;
• referring website;
• pages visited;
• date and time of access;
• login information;
• platform interactions;
• error information; and
• security and diagnostic logs.
We use this information to:
• operate our Services;
• authenticate Users;
• maintain security;
• detect misuse;
• investigate incidents;
• diagnose technical problems;
• understand usage; and
• improve performance.
We may receive information from:
• Customers;
• authorised Users;
• partners and resellers;
• suppliers;
• integrations enabled by Customers;
• publicly available business sources;
• events;
• business directories;
• marketing providers; and
• other organisations where collection is lawful.
Where required by applicable privacy law, we will take reasonable steps to provide relevant privacy information where Personal Information has been collected indirectly rather than directly from the individual.
Blacklock may use cookies and similar technologies to operate, secure and understand the use of our websites.
These may include:
Essential cookies required for authentication, security and core functionality.
Analytics cookies used to understand website performance and usage.
Preference cookies used to remember user settings.
Marketing cookies used where applicable to measure campaigns or provide relevant communications.
Where available, you may control non-essential cookies through our cookie preference controls.
You can also restrict cookies through your browser settings, although disabling certain cookies may affect website functionality.
Blacklock may process information to:
Provide the Services
This includes:
• creating and administering accounts;
• authenticating Users;
• providing access to the platform;
• performing authorised penetration testing;
• conducting vulnerability scanning;
• validating vulnerabilities;
• performing SAST and SBOM analysis;
• providing attack surface and vulnerability management;
• generating security findings and reports;
• providing remediation information;
• supporting integrations;
• performing retesting; and
• providing technical support.
Protect Blacklock and our Customers
We may process information to:
• detect unauthorised access;
• protect accounts;
• monitor security;
• investigate suspicious activity;
• prevent abuse;
• manage vulnerabilities;
• maintain logs; and
• investigate security incidents.
Operate and improve our Services
We may use information to:
• troubleshoot problems;
• understand feature usage;
• improve platform performance;
• conduct quality assurance;
• develop functionality; and
• improve our cybersecurity methodologies.
Where reasonably practicable, we use aggregated or de-identified information for analytics and product improvement.
Manage our relationship with you
We may process information to:
• provide customer support;
• administer contracts;
• process Orders;
• manage invoices;
• communicate service information;
• respond to enquiries; and
• manage partner and reseller relationships.
Comply with legal requirements
We may process information where reasonably necessary to:
• comply with applicable law;
• respond to lawful requests;
• protect legal rights;
• investigate suspected misconduct;
• maintain required records; and
• establish, exercise or defend legal claims.
Blacklock uses artificial intelligence and automated technologies to support cybersecurity functionality.
This may include:
• vulnerability validation;
• validation commands;
• vulnerability analysis;
• attack-path analysis;
• remediation guidance;
• vulnerability prioritisation;
• security-testing workflows; and
• generation of technical recommendations.
Information processed for these functions may include:
• vulnerability information;
• technical findings;
• evidence;
• technology-stack information;
• configuration information;
• security context;
• validation information; and
• remediation context.
Blacklock uses AI functionality for cybersecurity purposes associated with providing and improving the Services.
Blacklock does not share or sell Customer Data to AI providers.
Blacklock will not intentionally use identifiable Customer Confidential or Technical Information to train publicly available AI models unless expressly agreed with the Customer.
AI outputs may contain errors or incomplete information and should be appropriately reviewed before recommendations are applied to production systems.
Customers retain ownership of their Customer Data.
Customers provide Blacklock with the limited rights necessary to host, process, transmit and analyse Customer Data to:
• provide the Services;
• conduct authorised security assessments;
• identify and validate vulnerabilities;
• generate reports;
• provide remediation guidance;
• provide support;
• operate integrations;
• maintain and secure the Services; and
• meet contractual and legal requirements.
Blacklock will not share or sell Customer Data.
We do not use Customer Data for unrelated advertising or marketing purposes.
Customer Data containing confidential security information is treated as confidential information in accordance with our contractual obligations and Terms of Use.
Blacklock only discloses information where reasonably necessary for legitimate business, contractual, security or legal purposes.
Service providers
We may engage providers that support:
• cloud infrastructure;
• hosting;
• software services;
• communications;
• authentication;
• monitoring;
• customer support;
• analytics;
• security;
• business operations; and
• professional services.
Service providers are permitted to access information only where reasonably required to provide their services and are subject to applicable contractual, confidentiality and security requirements. Customer Data or Information is not shared, by default.
Partners and resellers
Where Services are purchased through an authorised reseller, distributor or partner, we may share information necessary for:
• account administration;
• contracting;
• service delivery;
• support; and
• billing.
Professional advisers and insurers
Where reasonably necessary, information may be disclosed confidentially to:
• legal advisers;
• accountants;
• auditors;
• security advisers;
• professional indemnity insurers;
• cyber insurers; and
• associated claims-management professionals.
This may occur in connection with risk management, a security or privacy incident, legal advice, insurance notification, investigation, defence or management of a claim.
Disclosure will be limited to information reasonably required for the applicable purpose.
Corporate transactions
Information may be disclosed in connection with a merger, acquisition, financing, restructuring or sale of all or part of Blacklock's business, subject to appropriate confidentiality safeguards.
Legal requirements
We may disclose information where reasonably necessary to:
• comply with applicable law;
• comply with a lawful court order or regulatory requirement;
• establish or defend legal rights;
• investigate fraud or misconduct;
• protect Blacklock, our Customers or others; or
• respond to a security incident.
Where legally permitted and reasonably practicable, Blacklock will notify an affected Customer before disclosing its Customer Data pursuant to a compulsory legal request.
Blacklock uses cloud infrastructure to deliver its Services.
Our primary production environment is hosted in:
Amazon Web Services (AWS) – Sydney, Australia.
Blacklock also operates infrastructure in:
Microsoft Azure – New Zealand.
Depending on the relevant service, provider or Customer-authorised integration, certain information may also be processed in other locations.
Because Blacklock operates internationally and uses technology providers in different jurisdictions, information may be transferred or made available outside New Zealand.
Where Blacklock discloses Personal Information outside New Zealand, we take reasonable steps to ensure that the disclosure complies with applicable privacy law.
Depending on the circumstances, this may include ensuring that the recipient:
• is subject to the New Zealand Privacy Act 2020;
• is located in a jurisdiction providing comparable privacy safeguards;
• agrees contractually to provide safeguards comparable to those required under New Zealand law;
• participates in another legally recognised privacy protection mechanism; or
• receives the information with the individual's appropriately informed authorisation where permitted by law.
Blacklock also seeks to limit overseas disclosures to information reasonably necessary for the relevant service or business purpose.
Blacklock implements technical, organisational and administrative safeguards designed to protect Personal Information and Customer Data against:
• unauthorised access;
• misuse;
• alteration;
• loss;
• destruction; and
• unauthorised disclosure.
Controls may include:
• encryption in transit;
• encryption at rest;
• access controls;
• role-based access;
• multi-factor authentication for all parties (customer, reseller or partner, staff);
• network restrictions;
• IP whitelisting where applicable;
• logging and monitoring;
• vulnerability management;
• penetration testing;
• secure software-development practices;
• backups;
• incident-response procedures;
• employee confidentiality obligations; and
• supplier security management.
Blacklock maintains an information security management programme and is ISO/IEC 27001:2022 certified.
Access to Customer Data is restricted to authorised personnel with a legitimate need for access.
No information system can be guaranteed to be completely secure, and Blacklock cannot guarantee that security incidents will never occur.
As part of its broader risk-management programme, Blacklock maintains cyber insurance and professional indemnity insurance relating to applicable risks and claims.
The existence of insurance:
• does not change the allocation of liability agreed in Blacklock's Terms of Use, Orders or other written agreements;
• does not create a separate right for a Customer or other individual to recover directly under an insurance policy; and
• remains subject to the relevant insurance policy terms, conditions, limits and exclusions.
Where an incident or claim may fall within applicable insurance coverage, Blacklock may provide relevant information to its insurer, broker, legal advisers or claims-management providers where reasonably necessary to notify, investigate, manage or defend the matter.
Blacklock maintains processes for investigating and responding to suspected security and privacy incidents.
Where an incident occurs, Blacklock will take steps to:
• contain the incident;
• investigate its cause and scope;
• mitigate potential harm;
• restore affected Services;
• preserve relevant evidence;
• notify affected Customers;
• prepare security incident report;
• engage appropriate advisers or insurers; and
• meet applicable legal and contractual notification requirements.
Where a privacy breach meets the applicable threshold for notification under the New Zealand Privacy Act 2020, Blacklock will notify the Office of the Privacy Commissioner and affected individuals as required by law.
Where Blacklock processes affected information on behalf of a Customer, Blacklock will notify and reasonably assist that Customer in accordance with applicable contractual obligations.
Blacklock treats Customer security information and other confidential Customer information as confidential.
Blacklock restricts access to individuals who reasonably require the information to:
• provide the Services;
• support the Customer;
• operate or secure the platform;
• comply with contractual obligations; or
• meet legal requirements.
Blacklock may disclose Confidential Information where required by law or otherwise permitted under an applicable agreement.
Confidential Information does not generally include information that:
• becomes publicly available without breach of an obligation;
• was lawfully known before disclosure;
• is lawfully obtained from another source;
• is independently developed without use of the Confidential Information; or
• is authorised for disclosure.
Blacklock retains Personal Information and Customer Data only for as long as reasonably necessary for its intended purpose, contractual requirements and applicable law.
Unless another period has been agreed with a Customer, Blacklock generally retains relevant Customer information, including vulnerability information and penetration-testing reports, for up to three years, unless deleted earlier at the Customer's request or through available platform functionality.
Different retention periods may apply to:
• account information;
• audit and security logs;
• financial records;
• contractual records;
• support information;
• backups;
• security incidents;
• legal claims; and
• information subject to regulatory or legal retention obligations.
Information may be retained for longer where reasonably required to establish, exercise or defend legal claims, including matters involving Blacklock's insurers. Please email us at privacy@blacklock.io to access our full Data Retention policy.
Backups may continue to contain information for a limited period until they are automatically overwritten or deleted in accordance with Blacklock's backup-management processes.
Where information has been securely anonymised so that an individual can no longer reasonably be identified, Blacklock may retain it for security, research, analytics or service-improvement purposes.
Your rights depend on the privacy laws applicable to you.
Under New Zealand privacy law, individuals may request:
• confirmation of whether Blacklock holds Personal Information about them;
• access to Personal Information Blacklock holds about them; and
• correction of Personal Information they believe is inaccurate.
Other applicable privacy laws may provide additional rights, including rights concerning:
• deletion;
• restriction of processing;
• objection to processing;
• data portability; and
• withdrawal of consent.
Blacklock may need to verify your identity before responding to a request.
Where Blacklock processes the relevant information solely on behalf of a Customer, we may refer the request to that Customer or assist the Customer in responding.
Certain requests may be declined or limited where permitted by applicable law.
Where permitted by law, Blacklock may send business contacts information concerning:
• cybersecurity services;
• platform updates;
• product announcements;
• educational content;
• events;
• webinars; and
• other Blacklock services.
You may unsubscribe from marketing communications using the unsubscribe mechanism in the relevant message or by contacting us.
Customers are responsible for ensuring that:
• they are authorised to submit assets to Blacklock for testing;
• they have a lawful basis for Personal Information contained within Customer Data;
• Customer Data supplied to Blacklock does not unlawfully infringe third-party rights;
• appropriate Users are authorised to access the Customer's account;
• access is revoked when no longer required;
• integrations are appropriately authorised;
• credentials, API keys and authentication mechanisms under their control are secured; and
• their use of Blacklock complies with applicable law.
Customers should avoid providing Personal Information that is unnecessary for the Services being performed.
Blacklock is a cybersecurity provider, and the Services inherently process information about security weaknesses and Customer environments.
Security Data may contain:
• vulnerabilities;
• configurations;
• infrastructure information;
• authentication behaviour;
• application behaviour;
• source-code findings;
• software dependencies;
• exploitability information;
• remediation information; and
• other sensitive technical information.
Blacklock treats such information as confidential Customer Data.
Blacklock uses Security Data only where reasonably necessary to:
• provide authorised security Services;
• validate findings;
• support remediation;
• conduct retesting;
• generate testing reports;
• provide support; or
• meet applicable contractual and legal requirements.
A Customer must not submit an asset to Blacklock for testing unless it owns the asset or has appropriate authorisation from its owner.
Our websites and Services may contain links to third-party websites.
Blacklock is not responsible for the privacy, security, availability or content of third-party websites that are outside our control.
We recommend reviewing the applicable third party's privacy policy before providing Personal Information.
Blacklock may update this Privacy Policy where necessary to reflect:
• changes to our Services;
• changes to our technology;
• new integrations;
• changes to our data-processing practices;
• security developments;
• legal or regulatory changes; or
• operational changes.
The latest version will be published on the Blacklock website with its last-updated date.
Where a change materially affects how existing Customer Personal Information or Customer Data is processed, Blacklock will provide reasonable notice where appropriate or legally required.
Changes to this Privacy Policy do not override separately negotiated contractual obligations unless expressly agreed.
If you have a concern about Blacklock's handling of Personal Information, please contact us.
We will review privacy complaints and make reasonable efforts to resolve them.
Individuals may also have the right to complain to an applicable privacy regulator.
In New Zealand, complaints may be made to the:
Office of the Privacy Commissioner of New Zealand
For questions regarding this Privacy Policy, privacy requests or complaints, contact:
Privacy Officer
Blacklock Security Limited
Taiawa Tech Hub
Level 5, 33 Bunny Street
Wellington Central
Wellington 6011
New Zealand
Email: privacy@blacklock.io
Phone: 0800 114 505
Website: blacklock.io
Please provide sufficient information for us to understand, verify and respond to your request.
Last updated: 17 October 2026