Privacy Policy

1. Our Commitment

Parachute Security Pty Ltd ("the Company," "we," "us," or "our") (Level 12, 88 Phillip Street, Sydney NSW 2000, Australia) operates the Parachute incident-response automation platform at withparachute.org. We handle personal information in accordance with the Australian Privacy Principles ("APPs") under the Privacy Act 1988 (Cth) and applicable state privacy legislation. For privacy matters, contact us at [email protected].

Parachute's core service processes data that customers and their infrastructure submit when automated runbooks execute: alert payloads from connected monitoring tools, incident metadata, evidence artefacts collected from customer cloud environments during containment actions, and the integration credentials required to perform those actions on the customer's behalf. This policy covers how we handle that operational data, along with personal information collected from individuals who visit withparachute.org or use the platform.

2. Information We Collect

We collect personal information in the following categories:

Account and contact data. When you register for a Parachute workspace or contact us, we collect your name, work email address, and company name.

Integration credentials. To execute runbooks on your behalf, the Company stores the API tokens and OAuth credentials you provide for connected tools, including PagerDuty, Datadog, Opsgenie, Slack, and cloud providers such as AWS. These credentials are stored encrypted and are used only to authenticate the runbook actions your team has configured.

Incident and alert data. When your monitoring tools send alerts to Parachute, we receive and process the alert payload, incident metadata, runbook execution logs, AI-generated incident timelines, and post-mortem summaries produced during automated response.

Evidence data. During automated containment actions, Parachute may collect evidence artefacts from your connected cloud environment, including CloudTrail logs, process snapshots, and network flow captures. This data is stored within your workspace for the duration of your configured retention window and permanently deleted at expiry.

Technical and usage data. We automatically collect IP address, browser type, operating system, session identifiers, feature usage statistics, and error logs when you interact with the platform.

Communications. Messages you send to us via email or the contact form on withparachute.org.

3. Purposes (APP 3, 6)

We collect and use personal information only for purposes reasonably necessary to operate the Service, including:

• Authenticating with your connected tools and executing automated runbook actions on your behalf;
• Generating AI-drafted incident timelines and post-mortem summaries;
• Storing and presenting incident evidence within your configured retention window;
• Maintaining the security, reliability, and integrity of the platform;
• Communicating with you about the Service, including billing notifications and product updates you have opted into;
• Diagnosing errors and improving platform reliability; and
• Complying with applicable legal obligations.

We do not use your incident data, evidence artefacts, runbook content, or other customer-submitted content to train or improve AI models without explicit written consent from your account administrator.

4. Disclosure (APP 6, 8)

We disclose personal information to:

• Infrastructure and cloud service providers acting as processors on our behalf, including hosting, storage, and compute providers;
• Third-party analytics and monitoring providers under data-processing agreements; and
• Regulatory and law enforcement authorities where disclosure is required by applicable law.

Where personal information is disclosed to recipients located outside Australia, we take reasonable steps to ensure those recipients handle the information in a manner consistent with the APPs or are subject to substantially similar privacy protections under the law of their jurisdiction.

The Company does not sell personal information.

5. Data Retention

Evidence data collected during automated runbook actions is retained for your configured retention window: 30 days on the Starter plan, 90 days on the Professional plan, or a custom window on Enterprise plans. Evidence data is permanently deleted at the end of the retention window.

Account and contact data is retained for the duration of your active subscription and for up to 12 months after account closure, after which it is deleted or de-identified unless we are required to retain it by applicable law.

Integration credentials are retained only while they are actively connected to your workspace. They are deleted within 30 days of disconnection or account closure.

6. Automated Processing and AI Features

Parachute uses AI to generate incident timelines and post-mortem summaries from alert payloads and evidence data collected during runbook execution. These outputs are generated within your workspace and are not used to train external AI models. AI-generated content is provided as a draft for your team to review and does not constitute professional security or legal advice.

7. Your APP Rights

Under the Australian Privacy Principles, you have the following rights:

• APP 12 - Right to access the personal information we hold about you;
• APP 13 - Right to request correction of personal information that is inaccurate, incomplete, or out of date;
• APP 7 - Right to opt out of direct marketing communications; and
• APP 2 - Right to deal with us anonymously or under a pseudonym where lawful and practicable.

To exercise any of these rights, email us at [email protected]. We will respond within 30 days. We may need to verify your identity before processing certain requests.

8. Complaints

If you believe the Company has not complied with the APPs in handling your personal information, please contact us first at [email protected] so we can attempt to resolve the matter. If the issue remains unresolved after 30 days, you may lodge a complaint with the Office of the Australian Information Commissioner ("OAIC") at oaic.gov.au.

9. Notifiable Data Breaches

If a data breach involving personal information held by the Company is likely to result in serious harm to affected individuals, we will notify those individuals and the OAIC in accordance with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth).

10. Cookies

For information about how we use cookies and similar technologies on withparachute.org, please see our Cookie Policy.

11. Contact

For any questions about this Privacy Policy or how we handle your personal information: