Last updated November 12, 2026
Information collected
We collect contact and organization details, domain, service preference, message, and documents you submit. We record intake references, consent versions and timestamps, review status, and payment reconciliation details. Technical abuse-prevention counters use a salted IP-address hash and are periodically removed after expiry. We do not request network passwords.
Purpose
We use information to assess fit and document completeness, agree scope, provide the review, communicate about the engagement, maintain business records, prevent abuse, and meet legal obligations. Providing a phone number does not opt you into marketing or text messages.
Storage and access
Intake records are stored in Google Sheets and documents in a restricted Google Drive folder. Uploads travel over HTTPS. Access is limited to authorized MOAT personnel, assigned reviewers, and necessary service providers. Client files are not published or shared through public links. Google Workspace provides encryption in transit and at rest; MOAT does not represent that it supplies client-side or end-to-end encryption.
Service providers
We use Google Workspace for records, files, and email; our hosting platform and Cloudflare for web delivery; Zoom for booking and communications; and Stripe for payment processing. These services process information necessary for their functions under applicable contractual terms. Assigned reviewers are subject to confidentiality obligations. We do not sell personal information or provide client documents to IT vendors for marketing.
AI and model training
MOAT does not use client documents to train AI models. The intake performs no AI analysis and does not forward documents to an AI provider. Any AI-assisted review requires an approved business service with contractual no-training controls and appropriate confidentiality arrangements. A prompt is not a substitute for those controls.
What to leave out
Submit only IT paperwork necessary for review. Redact client identities, matter details, account numbers, and unnecessary personal information. Do not upload passwords, private keys, patient records, or privileged legal advice. Contact us first if relevant material cannot be suitably redacted.
Retention and deletion
We retain information only as reasonably necessary for the engagement, business records, legal obligations, dispute resolution, and enforcement of agreements. A written scope may set a specific retention period. We review incomplete uploads and unnecessary documents for removal. You may request access, correction, or deletion; we verify identity and explain any legal or contractual reason to retain data. Removal from active storage is subject to provider backup and recovery cycles.
Communications and SMS
We send intake confirmations and service communications. SMS consent, when separately requested, is optional and not a condition of services. Mobile opt-in information and SMS consent are not shared for third-party marketing. The SMS Terms describe separately authorized text communications.
Cookies and external services
Our website and external booking or payment services may use cookies needed for functionality. External services maintain their own privacy notices. Avoid unnecessary confidential information in booking notes.
Security and requests
We use reasonable technical, administrative, and contractual safeguards. No storage or transmission method eliminates every risk. Contact hello@moatcybersecurity.com or 914-288-6068 for privacy requests. The effective date identifies the current policy.