Privacy Policy

1. Scope and roles

This policy applies to the Attest websites, applications, assessment experiences, account services, and support interactions that link to it. Attest is primarily a business service used by organizations to run AI readiness, governance, policy, training, attestation, and evidence workflows.

When an organization provides or directs us to process workforce or assessment information, that organization controls why the information is used. Questions about an employer’s or customer organization’s use of that information should first be directed to the organization’s administrator. We remain responsible for information we collect for our own account administration, security, support, and service operations.

2. Information we collect

Account and organization information

We may collect names, business email addresses, job titles, company details, account credentials, identity-provider identifiers, directory attributes, and administrator-configured roles.

Assessment, policy, and evidence information

Attest may process assessment responses, campaign participation, policy content, training activity, acknowledgements, signatures, timestamps, document versions, evidence records, and related organizational metadata. Whether responses are identified or anonymized depends on the campaign configuration and the organization’s instructions.

Technical and usage information

We collect information needed to operate and protect the service, such as IP address, browser and device information, request timestamps, authentication events, session activity, referring pages, diagnostic logs, and interactions with product features.

Communications

We receive information you provide through contact forms, support requests, onboarding, product feedback, and other communications with us.

3. How we use information

We use personal information to:

• Provide, administer, authenticate, and support Attest.
• Create and manage accounts, organizations, assessments, campaigns, policies, training, attestations, evidence, and reports.
• Maintain security, investigate misuse, prevent fraud, and protect users and the service.
• Respond to questions, service requests, and administrative instructions.
• Measure service performance, diagnose problems, and improve usability and reliability.
• Comply with applicable law, enforce agreements, and establish or defend legal rights.

Where required, we rely on an appropriate legal basis such as performance of a contract, legitimate business interests, consent, or compliance with law.

4. How information is disclosed

We may disclose information:

• To the customer organization: authorized administrators and users may access information according to their roles and campaign settings.
• To service providers: vendors may process information for hosting, communications, security, support, analytics, or other operational services under contractual restrictions.
• For legal and safety reasons: when reasonably necessary to comply with law, legal process, or valid government requests; protect rights or safety; or investigate misuse.
• In a business transaction: as part of a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality protections.
• With your direction or consent: when you or the customer organization asks us to connect or disclose information to another service or recipient.

Attest does not sell personal information for monetary consideration.

5. Retention and security

We retain information for as long as reasonably necessary to provide the service, meet contractual commitments, maintain appropriate business and security records, resolve disputes, and comply with legal obligations. Customer-controlled information may also be retained or deleted according to the customer’s plan, settings, instructions, and agreement with us.

We use administrative, technical, and organizational safeguards designed to protect information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

6. Choices and privacy requests

You may request access, correction, deletion, or another privacy right available under applicable law. If your information was provided by an employer or customer organization, contact that organization first so it can evaluate and direct the request. You may also contact us using the address below.

Attest uses cookies and similar local storage needed for authentication, session continuity, security, theme preferences, and service measurement. Browser settings can control some storage, but blocking essential storage may prevent sign-in or other features from working.

7. International use, children, and changes

Information may be processed in the United States and other locations where we or our service providers operate. Attest is a business service and is not directed to children under 16.

We may update this policy as the service or applicable requirements change. We will post the revised policy here and update the effective date. Material changes may also be communicated through the service or to customer administrators.