Privacy

This policy applies to fzoirm.com and all subdomains, including issuer.fzoirm.com, ssii.fzoirm.com, and any future subdomain operated under this domain.

What we collect

A one-way hash of your IP address (SHA-256, truncated to 16 characters). Not reversible. Not correlatable to an identity without the original IP at the same moment.
A timestamp of each request.
The company identifier (CIK, company number, or equivalent) you query.
ssii.fzoirm.com only: Your email address, as provided by your organization's identity provider during SSO login. Stored in a signed session cookie in your browser. Not stored server-side.
ssii.fzoirm.com only (self-serve onboarding): Your email address, sent a one-time verification link. The link token is stored for 15 minutes and deleted immediately upon use.

Why

Rate limiting — prevent abuse. Retained 1 hour, then auto-deleted.
Access logging — service delivery and accountability. Retained 30 days, then auto-deleted.
Scoring history — per-company trend analysis (velocity, persistence). Retained 365 days. Contains no personal data — only derived scores from public filings.
Session — authenticated access to ssii.fzoirm.com. The session is a signed cookie in your browser (12-hour expiry). We do not maintain a server-side session store. When the cookie expires, we have no record of your session.
Onboarding verification — confirm email ownership. Token deleted on use. No email is retained after verification.

What we do not collect / which may change, and so is this entire privacy policy, once our governance system opened for business

Names, account data, or any identifier beyond email (and only for ssii SSO).
Cookies for tracking, advertising, or analytics. The session cookie is the only cookie set, and it is functional, not tracking.
Content of public filings (fetched live, processed in-memory, never stored).
Telemetry payloads sent to the integrity webhook (processed in-memory, not persisted).
Passwords, MFA codes, or credentials from your identity provider. We never see your password. SSO is handled between your browser and your organization's IdP.

What we store for your organization (tenant-level)

Your organization's OIDC configuration (client ID, client secret, issuer URL, JWKS URL). Stored to enable SSO. Deleted upon tenant deprovisioning.
This is your organization's data, not individual user data. Accessible only by our operations team.

What we do not do

Share, sell, or transmit your data to any third party.
Use your data for advertising, profiling, or cross-site tracking.
Combine your data with data from other services or platforms.
Access your identity provider directly. SSO is a browser-to-IdP flow. We receive a signed token, not a password.
Retain session data after cookie expiry. No server-side session store exists.

Deletion

To request deletion of any logged entry, send an email with the approximate date and company identifier (or your email for ssii sessions). We will confirm deletion within 72 hours.

To deprovision your organization's SSO configuration, send an email. All tenant-level data is deleted within 72 hours of confirmation.

Public data

All scoring on issuer.fzoirm.com is derived exclusively from public regulatory filings (SEC EDGAR, Companies House, and equivalent public registries). No non-public data is ingested, stored, or processed.