Privacy Policy

MARFI Systems, Inc. is a California corporation operating from 2219 Main Street, Santa Monica, CA 90405. We provide AI-native managed IT and cybersecurity services to organizations across the United States.

This Privacy Policy covers:

• All MARFI Products: Launchpad (managed IT), Raptor (AI-native penetration testing), CyberTrustScore (domain security scanner), Secureframe (compliance platform), Meter (networking infrastructure), BOOST (SaaS procurement), and Professional Services (consulting, engineering, incident response)
• All Individuals: Clients, Users, Authorized Users, website visitors, CyberTrustScore users (including unregistered users), and any individual whose personal information MARFI processes
• All Touchpoints: marfi.io website, billing portal (billing.marfi.app), trust center (trust.marfi.io), service platforms, APIs, and all MARFI-operated systems

This Privacy Policy is incorporated by reference into our Terms of Service. When there is a conflict between this Privacy Policy and the Terms of Service, the Terms of Service govern.

MARFI collects different types of information depending on which products and services you use. This section is organized by collection method and by product for transparency.

2.1, Information You Provide

• Account Registration: Name, email address, company name, phone number, job title
• Service Orders: Billing information, company address, authorized contacts, payment method details
• Billing Portal: Login credentials for billing.marfi.app/client, payment information processed through Stripe or Mercury Bank ACH, invoice viewing history
• Support Requests: Issue descriptions, screenshots, system access credentials (temporary), environment details
• Raptor: Target system information (IPs/domains), scan configurations, authorization documentation, authenticated user identity
• CyberTrustScore: Email address (optional for registered accounts), domain ownership verification (email match or DNS TXT record)
• Professional Services: System access credentials, environment documentation, incident details

2.2, Information Collected Automatically

Website & Marketing:

• IP address, browser type, operating system, device identifiers
• Pages visited, referral source, session duration, click patterns

Launchpad (Managed IT):

• Device inventory (hardware specs, OS version, installed software)
• Login events, authentication activity, failed login attempts
• Security events, endpoint telemetry, patch status
• Security alerts, network metadata, threat intelligence correlations
• Incident event data, detection activity, response actions

Raptor (Penetration Testing):

• Scan execution data: target IPs/domains, scan parameters, timestamps
• User identity, authentication events, scan results, vulnerability findings
• Complete scan activity logs retained by MARFI for compliance and law enforcement purposes

CyberTrustScore (Domain Scanner):

• IP address (for rate limiting), scan requests, domains queried
• Widget analytics (for embedded widgets): anonymized page views, interaction data, referral sources
• No personally identifiable information collected from widget visitors without separate consent

2.3, Information from Third Parties

MARFI receives information from subprocessor platforms used to deliver services:

• CrowdStrike threat detections and endpoint telemetry
• JumpCloud identity events and device management data
• Arctic Wolf security alerts and SIEM correlations
• Avanan/Check Point email security events
• Dropsuite backup logs and recovery events

CyberTrustScore Public Data: CyberTrustScore scans publicly observable data including DNS records, email authentication headers (DMARC, DKIM, SPF), SSL/TLS certificates, and HTTP security headers. No consent from domain owners is required for this publicly available data.

MARFI uses personal information for the following purposes:

3.1, Service Delivery

Providing, maintaining, and operating all MARFI services. This includes managing employee identities (Launchpad), monitoring security threats (Launchpad), executing penetration tests (Raptor), scoring domain security (CyberTrustScore), facilitating compliance (Secureframe), managing network infrastructure (Meter), and procuring software licenses (BOOST).

3.2, Security Operations

Detecting, investigating, and responding to security threats, incidents, and anomalies. This includes analyzing security event data, correlating threat intelligence, performing incident response, and maintaining SOC operations through CrowdStrike and Arctic Wolf partnerships.

3.3, AI & Automation

AI Governance

MARFI does NOT train AI models on Client Data.

• AI capabilities (Automation Engine, MARFI AI, Raptor’s 13-agent AI pipeline) are used for real-time inference only
• No persistent model training occurs using Client Data
• If MARFI changes an AI model provider used in service delivery, MARFI will provide 30 days’ written notice
• Raptor’s AI pipeline processes scan data for real-time vulnerability analysis, no training dataset generation

3.4, Communications

Sending technical notices, security alerts, support messages, service updates, invoices, and transactional communications necessary for service delivery.

3.5, Analytics & Improvement

Monitoring service usage patterns, performance metrics, and operational trends using anonymized and aggregated data only. Individual-level analytics are used solely for service delivery and security operations, not for marketing or profiling.

3.6, Compliance & Legal

Fulfilling legal obligations, responding to legal process (subpoenas, court orders, government requests), enforcing our Terms of Service, protecting MARFI’s rights and property, and ensuring compliance with applicable laws and regulations.

3.7, Billing & Transactions

Processing payments, managing subscriptions, generating invoices, and handling billing disputes. Stripe processes payment transactions for Raptor subscriptions. MARFI does not store credit card numbers.

4.1, We Do Not Sell Personal Information

MARFI does not sell, rent, or trade personal information to third parties. Period.

4.2, Subprocessors

MARFI shares Client Data with subprocessors solely for service delivery. All subprocessors are contractually required to maintain confidentiality and security.

Named Subprocessors

• JumpCloud, Identity management & device management (Launchpad)
• CrowdStrike, Endpoint detection & response, SOC operations (Launchpad)
• Arctic Wolf, Security monitoring & SIEM (Launchpad)
• Avanan / Check Point, Email security & data loss prevention (Launchpad)
• Dropsuite, Email backup & data recovery (Launchpad)
• PHIN Security, Security awareness training (Launchpad)
• Atera, Remote monitoring & management (Launchpad)
• Secureframe, Compliance automation (Secureframe service)
• Meter, Network infrastructure management (Meter service)
• Stripe, Payment processing (Raptor subscriptions)
• Stack Auth, Authentication services (Raptor platform)
• Anthropic, AI model provider (MARFI AI, Raptor AI pipeline, Emergent)
• OpenAI, AI model provider (MARFI AI, Emergent, Launchpad)
• Google, Cloud infrastructure & AI services (GCP, Gemini for MARFI AI, Emergent, Launchpad)
• Microsoft, Cloud infrastructure & productivity services (Azure, M365)
• AWS, Cloud infrastructure, hosting, storage (Amazon Web Services)
• Cloudflare, CDN, DDoS protection, DNS, web application firewall
• Elestio, Cloud hosting & infrastructure platform
• Emergent, DevOps & custom solutioning platform

Complete, current subprocessor list maintained at trust.marfi.io. MARFI provides 30 days’ notice before engaging a new subprocessor. Clients have a 15-day objection window following notice.

4.3, Legal & Law Enforcement

MARFI may disclose personal information when required by law, court order, or government request, or to protect the rights, safety, or property of MARFI, Clients, or the public.

Raptor Law Enforcement Disclosure

In the event of suspected misuse, unauthorized scanning, or illegal activity, MARFI may disclose Raptor scan logs, account information, and related data to law enforcement authorities, regulatory bodies, or affected third parties WITHOUT prior notice to Client and WITHOUT Client’s consent.

MARFI retains complete scan activity logs including: target IPs/domains, scan parameters, timestamps, user identity, and results. By using Raptor, Client acknowledges and accepts this disclosure term.

4.4, Business Transfers

In the event of a merger, acquisition, or asset sale, personal information may be transferred as part of that transaction. MARFI will provide notice before personal information becomes subject to a different privacy policy.

4.5, With Your Consent

MARFI may share personal information with third parties when you provide explicit consent for a specific purpose.

MARFI’s role in processing personal information depends on the service and context. This section aligns with Terms of Service §8.1.

5.1, Managed Services (Launchpad, Meter)

For Managed Services:

• Client is the data controller. Client determines what personal information is collected and processed.
• MARFI is the data processor. MARFI processes Client Data solely as instructed by Client and for the purpose of delivering the Services.
• Where a Data Processing Addendum (DPA) is required by law (e.g., GDPR), it is attached as an exhibit to the applicable Service Order.

5.2, SaaS Products (Raptor, CyberTrustScore)

• Raptor: Client is generally the data controller of scan data they submit. MARFI is the data processor. MARFI retains scan logs as an independent controller for compliance and law enforcement purposes.
• CyberTrustScore: For user-submitted scans, Client/User is the controller. For publicly available data scanned without user submission, MARFI acts as an independent controller. The CyberTrustScore database is public.

5.3, BOOST (SaaS Procurement)

MARFI processes billing and license allocation data as a processor on Client’s behalf. Underlying software vendors are independent controllers for data processed through their platforms.

5.4, Website & Marketing

MARFI is the data controller for information collected through marfi.io, billing.marfi.app, and trust.marfi.io.

MARFI implements comprehensive technical and organizational measures to protect personal information. This section aligns with Terms of Service §10.

6.1, Security Standards

Reports & attestations

• SOC 2 Type I & Type II, independent examination; report available under NDA
• HIPAA, Business Associate Agreements signed with covered Clients; HIPAA addendum to our SOC 2 examination (HIPAA has no certification regime)

Aligned (frameworks we map to, not certifications held)

• ISO 27001, Information security management
• NIST 800-171, Protecting Controlled Unclassified Information
• CMMC, CIS, Framework alignment
• FedRAMP, Advisory alignment only

6.2, Technical Measures

• Encryption at rest: AES-256 encryption for data at rest
• Encryption in transit: TLS 1.2+ for all data transmission
• Multi-factor authentication: Required on all administrative access
• Role-based access controls: Least privilege access model
• Network segmentation: Isolated environments for Client Data
• Endpoint protection: EDR on all MARFI systems (CrowdStrike)

6.3, Organizational Measures

• Penetration testing: Annual testing by independent third party
• Vulnerability monitoring: Continuous scanning and remediation
• Security training: All MARFI personnel complete security awareness training
• Background checks: All personnel with access to Client Data undergo background screening
• Incident response: Documented procedures, 72-hour breach notification

6.4, Trust Center

Security documentation, compliance reports, and subprocessor information are available at trust.marfi.io. MARFI’s SOC 2 Type II report is available upon request under NDA.

MARFI retains personal information for different periods depending on the type of data and the service. This section aligns with Terms of Service §8.5, §8.6, §8.7.

7.1, Active Service Period

Client Data is retained for the duration of the service engagement. Retention periods vary by product and data type based on operational and legal requirements.

7.2, Post-Termination

Data Return & Deletion Requirements

• Data Return: MARFI will provide Client Data in machine-readable formats within 30 days of Client’s written request following termination.
• Data Deletion: MARFI will delete Client Data within 90 days of termination, but ONLY after receiving a signed deletion request from an authorized Client representative. MARFI will NOT unilaterally delete Client Data. Written certification of deletion provided upon completion.
• Retained Records: Contracts, invoices, and audit logs are retained for 3 years after termination regardless of deletion request. This is required for financial reporting, tax compliance, and legal obligations.
• Anonymized/Aggregated Data: Data that cannot identify Client or any individual is retained indefinitely for analytics, research, and service improvement.

7.3, Product-Specific Retention

Raptor:

• Scan reports retained 12 months from scan date, then deleted. Client may request extension in writing before retention period expires.
• Scan activity logs (targets, parameters, timestamps, user identity) retained by MARFI for compliance and law enforcement purposes. Retention period not disclosed to prevent circumvention.

CyberTrustScore:

• Scan results in public database retained indefinitely unless domain owner requests removal via the contact form (30 business days processing time).
• Removal does not prevent re-scanning if a third party initiates a new scan. Permanent exclusion requires a separate written agreement.
• Account data retained until account deletion.

Website Analytics:

Aggregated, anonymized. No individual-level retention beyond session duration.

8.1, What We Use

• Essential Cookies: Session management, authentication, security features. These are required for service functionality.
• Analytics Cookies: Service usage monitoring, performance metrics. Anonymized data only.
• No Advertising Cookies: MARFI does not serve ads and does not use third-party advertising trackers or cross-context behavioral advertising.

8.2, CyberTrustScore Widget

Embedded CyberTrustScore widgets collect anonymized usage analytics:

• Page views, interaction data, referral sources
• No personally identifiable information collected from widget visitors without separate consent
• Widget host sites are responsible for their own cookie disclosures and privacy policies
• Widget users must ensure their use of the widget complies with their own privacy policies and applicable data protection laws

8.3, Your Choices

You can control cookie acceptance through your browser settings. Disabling essential cookies may affect service functionality. MARFI does not sell or share personal information, and MARFI honors recognized universal opt-out preference signals, including the Global Privacy Control (GPC), as well as Do Not Track signals, where technically feasible.

Depending on your location and the services you use, you may have the following rights regarding your personal information:

9.1, Access & Portability

You have the right to request a copy of your personal information. MARFI will provide data in a structured, machine-readable format (JSON, CSV, or similar). Response time: 30 days (may extend to 45 days for complex requests with notice).

9.2, Correction

You have the right to request correction of inaccurate or incomplete personal information. MARFI will verify and update records within 30 days of receiving a valid request.

9.3, Deletion

You have the right to request deletion of personal information, subject to:

• Legal retention obligations (tax, financial reporting, regulatory compliance)
• Retained Records (contracts, invoices, audit logs retained for 3 years post-termination)
• Active Service Orders (Client Data under Managed Services requires signed deletion request per Terms §8.6)
• Law enforcement holds or ongoing investigations

9.4, Opt-Out

You have the right to opt out of promotional communications at any time by clicking the "unsubscribe" link in any marketing email or using the contact form. Transactional and security communications (invoices, security alerts, service notices) are not subject to opt-out as they are necessary for service delivery.

9.5, Data Portability

Upon termination of Managed Services, Client may request data export in machine-readable formats per Terms §8.5. MARFI will provide data within 30 days of written request.

9.6, How to Exercise Rights

To exercise any of these rights:

• Use the contact form at marfi.io
• Mail: MARFI Systems, Inc., Privacy Team, 2219 Main Street, Santa Monica, CA 90405

MARFI will verify your identity before processing requests. Verification may require additional information such as email confirmation, account credentials, or government-issued ID.

No fee for the first request in a 12-month period. MARFI may charge a reasonable fee for excessive, repetitive, or manifestly unfounded requests.

9.7, US State Privacy Rights, Appeals & Disclosures

Residents of states with comprehensive privacy laws, including California, Virginia, Colorado, Connecticut, Texas, Utah, Oregon, Montana, and other states as their laws take effect, may confirm whether MARFI processes their personal information; access, correct, and delete it; obtain a portable copy; and opt out of targeted advertising, the sale of personal information, and certain profiling. MARFI does not sell personal information and does not process it for targeted advertising.

Appeals. If MARFI declines to act on your request, you may appeal by replying to our decision or by using the contact form at marfi.io. We will respond within the period your state’s law requires (generally 45-60 days). If your appeal is denied, you may contact your state Attorney General.

Notice at collection. The categories of personal information we collect and the purposes for which we use them are described in Sections 3-4 above; this serves as our notice at collection. Sensitive information. MARFI does not collect or use sensitive personal information beyond what is reasonably necessary to provide its services, and does not use it to infer characteristics about you. Retention. Where this Policy does not state a specific period, we retain personal information only as long as needed for the purposes described here, then delete or anonymize it.

California residents have specific rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA).

10.1, MARFI’s Role

• MARFI acts as a "service provider" under the CCPA/CPRA when processing Client Data on behalf of Clients for Managed Services.
• MARFI does not sell personal information.
• MARFI does not share personal information for cross-context behavioral advertising.

10.2, California Resident Rights

• Right to Know: What personal information is collected, used, disclosed, and sold (if any)
• Right to Delete: Request deletion of personal information (subject to exceptions)
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out of Sale: MARFI does not sell personal information, so this right is satisfied by default
• Right to Limit Use of Sensitive Personal Information: MARFI does not use or disclose sensitive personal information beyond what is reasonably necessary for service delivery
• Right to Non-Discrimination: MARFI will not discriminate against you for exercising your CCPA/CPRA rights

10.3, How to Submit a Request

California residents may submit requests via:

• Contact form at marfi.io
• Mail: MARFI Systems, Inc., Privacy Team, 2219 Main Street, Santa Monica, CA 90405

MARFI will verify your identity before processing requests. Authorized agents may submit requests on your behalf with written authorization from the consumer.

10.4, Categories of Information

The following table summarizes the categories of personal information MARFI collects, the business purposes, and the categories of third parties with whom it’s shared:

For a complete list of subprocessors and their functions, see trust.marfi.io.

Each MARFI product has unique data handling practices. This section aligns with Terms of Service §21.

11.1, Raptor (AI-Native Penetration Testing)

• Scan data (target IPs/domains, parameters, timestamps, user identity, results) is classified as Confidential Information
• Scan data is isolated per tenant in MARFI’s multi-tenant architecture. No cross-tenant data access.
• MARFI retains complete scan activity logs. These logs may be disclosed to law enforcement WITHOUT prior notice and WITHOUT Client consent for suspected misuse, unauthorized scanning, or illegal activity.
• Scan reports retained 12 months, then deleted unless Client requests extension in writing
• Payment processing via Stripe. MARFI does not store credit card numbers. Stripe’s privacy policy applies to payment data.
• Client is solely responsible for securing scan results after delivery

11.2, CyberTrustScore (Domain Security Scanner)

Public Database & No Consent Requirement:

• CyberTrustScore scans publicly available, externally observable data only (DNS, email authentication, SSL, HTTP headers). No consent from the domain owner is required.
• The CyberTrustScore database is public. Scan results for any domain may be visible to other users. Domain owners should not expect privacy for publicly observable data.

Account Registration (Optional):

• Basic scans: No account required. Only IP address collected (for rate limiting).
• Registered accounts: Email address and verified domain ownership (email match or DNS TXT record verification).
• Registered accounts may receive automated security alerts for owned domains.

Widget Analytics:

• Embedded widgets collect anonymized usage data: page views, interaction data, referral sources.
• No personally identifiable information collected from widget visitors without separate consent.
• Widget host sites must ensure their use complies with their own privacy policies.

Domain Owner Removal Requests:

Domain owners may request removal from the CyberTrustScore database using the contact form at marfi.io. Requests processed within 30 business days. Removal does not prevent re-scanning if a third party initiates a new scan. Permanent exclusion requires a separate written agreement with MARFI.

11.3, BOOST (SaaS Procurement)

• MARFI processes billing information and license allocation data on Client’s behalf as a data processor
• Underlying software vendors procured through BOOST have their own privacy policies. MARFI is not responsible for vendor data practices.
• Client should review the privacy policies of software procured through BOOST before use

12.1, Subprocessor List

MARFI maintains a complete, current list of subprocessors at trust.marfi.io. The following table summarizes key subprocessors:

12.2, Subprocessor Changes

• MARFI provides 30 days’ notice before engaging a new subprocessor
• Managed Services Clients have a 15-day objection window following notice
• Notice provided via email to the primary contact on the Service Order
• If Client objects, MARFI will work in good faith to address concerns or provide alternatives

12.3, Third-Party Links

MARFI services may contain links to third-party websites, applications, or platforms. MARFI is not responsible for the privacy practices of these third parties. We encourage you to review third-party privacy policies before providing information.

MARFI primarily processes data in the United States. Data may be transferred to and processed in jurisdictions where subprocessors operate.

MARFI ensures appropriate safeguards for international transfers, including:

• Contractual protections with subprocessors requiring security and confidentiality
• Security requirements aligned with SOC 2 Type II, HIPAA, ISO 27001, and NIST 800-171
• Encryption in transit and at rest for all transferred data

MARFI is a US-based provider and processes personal information in the United States. To the extent MARFI offers services to, or monitors the behavior of, individuals in the EU/EEA such that the GDPR applies, MARFI uses Standard Contractual Clauses (SCCs) approved by the European Commission where required; copies are available upon request using the contact form. MARFI does not target the EU/EEA market, and most users will not be subject to the GDPR.

MARFI does not maintain a formal GDPR Data Protection Officer unless required by law. For GDPR-related inquiries, use the contact form.

MARFI services are not directed to individuals under 13 years of age (or 16 in jurisdictions where applicable, such as the European Economic Area).

MARFI does not knowingly collect personal information from children. If we become aware that we have collected personal information from a child without parental consent, we will take steps to delete such information promptly.

If you are a parent or guardian and believe your child has provided personal information to MARFI, please use the contact form immediately.

MARFI may update this Privacy Policy at any time to reflect changes in our practices, legal requirements, or service offerings.

Material changes will be communicated via:

• Email to registered account holders
• Prominent notice on marfi.io
• Updating the "Last Updated" date at the top of this Privacy Policy

MARFI will provide 30 days’ notice before material changes take effect. Continued use of MARFI services after the notice period constitutes acceptance of the updated Privacy Policy.

For Managed Services Clients: changes that materially affect data processing obligations will be communicated directly to the authorized contact on the Service Order. Client may object to material changes within 15 days of notice. If MARFI cannot accommodate the objection, either party may terminate the Service Order without penalty.

For questions, concerns, or requests regarding this Privacy Policy or MARFI’s data practices, please contact:

Privacy Team

MARFI Systems, Inc.

2219 Main Street, Santa Monica, CA 90405

Trust Center: trust.marfi.io

If you are unsatisfied with MARFI’s response to a privacy concern, you may file a complaint with the relevant data protection authority in your jurisdiction. For California residents, contact the California Attorney General’s Office.