Trust Center

US State Privacy Laws

Blackpoint Cyber does not meet the conditions as outlined in Section 1798.140 of the California Consumer Privacy Act of 2018 (CCPA) and therefore is not subject to CCPA requirements. Blackpoint Cyber also does not meet the eligibility conditions outlined in the Virginia Consumer Data Protection Act, Colorado Privacy Act, Connecticut Data Privacy Act, Utah Consumer Privacy Act, Oregon Consumer Privacy Act, Florida Digital Bill of Rights, or Texas Data Privacy and Security Act and therefore is not subject to the requirements of these laws.

Recognizing the criticality of data privacy in today’s world, our customers can learn more about organizational and technical measures implemented in place to ensure privacy is integrated into our products, services, and operations by reviewing the information below.

General Data Protection Regulation (GDPR)

The European Union’s General Data Protection Regulation (GDPR) came into effect on May 25, 2018, and became effective in the UK post-Brexit on January 1, 2021. With a reputation for being one of the toughest data privacy and security laws in the world, it imposes obligations onto organizations anywhere, so long as they target or collect data related to people in the EEA or UK respectively.

Blackpoint Cyber acts as a data processor for our MSP partners, who in turn act as data controllers and are responsible for determining Blackpoint Cyber’s purposes and means of processing personal data in compliance with GDPR.

For additional information on how Blackpoint Cyber complies with GDPR, the implemented organizational and technical measures, as well as our list of subprocessors, download our GDPR Statement, Subprocessor List, or request our Data Processing Addendum (DPA).

You can review and execute Blackpoint Cyber’s DPA by contacting the privacy team. Blackpoint Cyber’s DPA covers the specific processing activities and security measures applicable to our Services and incorporates the new EU Standard Contractual Clauses (EU SCCs).

Blackpoint Cyber will make updates to the subprocessor list via the published Subprocessor List, which will be accessible via our Trust Center. Such changes will be reflected in our Data Protection Addenda (DPA). Our customers who subscribe below will be alerted to changes in the Subprocessor List.

Objecting to a Subprocessor

You may object to a subprocessor by emailing your objection to [email protected] with the subject line “Subprocessor Objection,” along with your name, your company’s name, the name of the subprocessor, and grounds for objection.

Privacy Mode

Privacy Mode is an optional configuration available to Blackpoint customers enrolled in MDR Services with the SNAP Agent deployed. When enabled, it is a technical control that prevents the SOC from being able to retrieve a file from a protected endpoint. This removes the risk that sensitive or regulated data, such as ePHI or CUI, could be incidentally transferred to Blackpoint’s systems during an investigation of an escalated alert.

By default, file retrieval is initiated only when a SOC Analyst needs deeper sandbox analysis during an active investigation. Even then, Blackpoint SOC Analysts never view file contents directly. If further analysis is required, Blackpoint will coordinate directly with the customer. Privacy Mode gives customers direct control over this capability, which can be configured on a per-tenant basis. Audit logs of changes to the Privacy Mode setting are available upon request.

Files on an endpoint may contain ePHI, CUI, FCI, CDI, ITAR-regulated data, or other sensitive types. Privacy Mode helps prevent Blackpoint’s SOC from collecting, accessing, processing, or storing that data, thereby supporting compliance with regulations including HIPAA, GDPR, and CMMC. With Privacy Mode enabled, only .log files and SNAP Agent log files are collected and transmitted to the Blackpoint SOC from the Agent. All other file retrieval from the endpoint is disabled.