Privacy Policy

SimulatedPhishManager is operated by CyberAuthority and provides authorized phishing simulations for businesses. This policy describes information handled through the application, including information supplied by organization administrators and activity generated when employees interact with simulations.

Your organization decides which employees participate and how campaign results are used within its business. Employees should contact their organization’s administrator about participation, workplace notices, and requests concerning organization-managed records.

• Authenticate users and apply organization and administrator permissions.
• Create, schedule, deliver, and measure authorized simulations and recognize suspicious-email reports.
• Provide company-specific dashboards, reports, templates, and administration.
• Provide limited local suspicious-email assessments without AI, external threat scanners, live URL reputation, URL retrieval, or antivirus checks; these assessments do not establish that a message is safe or malware-free.
• Manage subscriptions, payments and payment adjustments, recipient limits, policy consent, and service notices.
• Investigate delivery problems, prevent duplicate or unauthorized sending, and maintain the service.
• Generate requested content when an administrator chooses to use AI-assisted features.

Company administrators can access information made available for their organization. Authorized platform administrators can access information needed to operate, support, and administer the service. Company-created templates are private to that company; templates explicitly published by platform administrators are available in the marketplace.

Reports from company-specific reporting mailboxes are scoped to that company. Shared-mailbox report content is system-admin-only unless a system administrator assigns it to a company. Unverified sender addresses and domain matches do not establish company visibility. Company administrators can view and review assigned reports; system administrators can assign, close, and delete report content.

Optional assessment replies require current paid company access or an unexpired administrator grant and no service restriction. They are disabled by default, production-only, and use an explicitly selected active platform-owned sender. Current intake leaves forwarding identity unverified: a system administrator must separately verify company ownership and the actual forwarding reporter, assign the company, and explicitly confirm one unambiguous employee or approved portal roster recipient. Assignment, From/domain claims, original sender, Reply-To and simulation tokens alone never authorize replies. The transactional email contains a local risk rating, bounded defanged findings, recommended actions and assessment limits, not the original body, attachments or active suspicious URLs. It is not a safety or malware-free guarantee. Enabling replies does not backfill historical assessments.

Reply delivery records retain the confirmed recipient and company, confirmation actor/time, delivery state, bounded content-free reasons, attempt timestamps and minimal provider identifiers while the report exists. Eligibility and ownership are rechecked before dispatch; automated mail and system addresses are suppressed, with per-recipient/company/platform rate limits. Company administrators see delivery status only for their assigned reports. Unknown acceptance outcomes are not automatically resent.

The application uses Replit for hosting and database services, Clerk for authentication, and Stripe for billing. Configured email services, including Resend or an organization’s SMTP provider, receive the information necessary to deliver email. AI-assisted features use the configured AI services, including OpenAI through the application’s integration. Reporting-mailbox providers hold forwarded messages.

These providers process information under their own service terms and privacy practices. An organization’s selected SMTP or reporting-mailbox provider may have different retention and access controls from this application.

Authentication uses browser cookies or similar session mechanisms. Simulation emails use tracking identifiers, an email-open image, and tracked links to associate events with campaign records. Opening an email or following a simulation link can create an event without signing in to the application.

Email clients, security scanners, image proxies, and automated link inspection can affect recorded events. Organizations should interpret results in that context rather than treat every event as proof of a person’s actions.

Application access is controlled by authentication, roles, and organization-scoped permissions. Customer SMTP passwords configured through Billing are encrypted before storage and masked when displayed. These measures do not provide a guarantee that every system, connection, or record is immune to unauthorized access.

Administrators should use only authorized recipient information and avoid placing real passwords, unnecessary sensitive information, or confidential employee details in prompts, templates, or forwarded reports.

Retention and deletion behavior is explained in our Data Retention Information page. Cancellation does not automatically erase records, and deleting an employee does not remove every associated billing or usage record.

Employees should direct access, correction, or removal requests to their organization’s administrator. Company administrators should use their existing CyberAuthority service contact for platform-level requests. Identity and authority may need to be verified before a request is acted on; some records may need to remain for billing, security, dispute handling, or applicable requirements.

This policy describes the application’s current handling of information. The revision date identifies the practices described here; refer to the most recent published version when reviewing the service’s data handling.