Last Updated: January 10, 2022
Our quest to accelerate insight for security and technology practitioners requires collecting and processing a significant amount of data. Ensuring your data is used only in a manner consistent with your expectations is a responsibility we take very seriously, and we back the privacy statements below with layers of security to safeguard your data.
Rapid7, we, and us refers to Rapid7, Inc., Rapid7 LLC and any of our corporate affiliates.
For example, we collect information you provide in order to access our solutions, use our sites, subscribe to our content, or register for an activity associated with Rapid7. This may include, but is not limited to, your name, email address, telephone number, and mailing address.
If you make a purchase from Rapid7, become one of our vendors, or otherwise establish a relationship with us that involves financial transactions, we collect information about those transactions. This may include, but is not limited to, your credit or debit card information, account and authentication information, tax identifiers, and other billing, delivery, and contact details.
In order to provide our solutions and services to you, we must necessarily collect certain information automatically. This also helps us to ensure that our solutions and services are operating correctly. The types of information we collect include:
We also collect information about the solutions you use and how you use them, such as how often you access our products and which features you use most frequently. This is done in an effort to improve your experience with our solutions. For example, we may use this information to reach out to you if you seem “stuck” on a certain process within the solution, to make our solutions more intuitive, or to enhance the solution’s most popular features.
On our sites, Rapid7 and our third-party partners collect information using cookies and other tracking technologies. Please see our full Cookie Notice, which includes information on how to control or opt out of these cookies and tracking technologies.
We receive various types of information from third-parties on some occasions, such as when we jointly offer services or sponsor events. We also collect data from third party security providers and online databases in connection with our research activities that relate to active or historic threats, vulnerabilities, and risks around the world. This can include data like domain names, IP addresses, email accounts, and usernames that are associated with security risks (for example, known compromised accounts and usernames), and we use this information to enhance the security services we provide to you. Additionally, we may receive data from other third party sources including the public internet.
We are able to deliver our solutions and services, understand the behavior of attackers, and better help our customers keep their environments safe by using the information we collect above.
In general, we only process our customers' information to deliver our offerings on their behalf. Although we may collect the information listed above, we do not access information that we process on our customer’s behalf, such as user, network, vulnerability, incident, or asset information, unless our customers have requested we do so to investigate issues with our solution or carry out a service.
We use your information to communicate with you about our solutions, services, features, surveys, newsletters, offers, promotions, and events, and to provide other news or information about Rapid7 and our partners, in accordance with your communications preferences.
We will also use your information to respond to you when you contact us.
The vast majority of the data we collect through our research initiatives is data that’s publicly available. It is collected to educate and enrich the security community, and foster secure adoption of technology. For example, one of our research initiatives uses the metadata from publicly expose services to identify large-scale misconfigurations and vulnerabilities in consumer, enterprise, and critical infrastructure systems.
Information related to the research we conduct may be shared with various research and security organizations, including academic institutions or publications, but only when this information is already freely publicly available and/or non-identifiable. We may also publish this research online on our website or through third party social media sites.
Some third parties provide services on our behalf and may require access to your information to carry out that work, including billing, customer support, etc. These service providers are authorized to use your information only as necessary to provide the services in scope and are subject to strict contractual controls to protect the confidentiality and security of your information. If you’re a customer of our products or services, our list of subprocessors is available here.
We do not sell our customers’ personal information (as that term is defined in the California Consumer Privacy Act) and we will not sell such personal information without providing any required notice and/or right to opt-out of such sale.
We may share personal information with companies, organizations, or individuals outside of Rapid7 if we have a good-faith belief that access, use, preservation, or disclosure of the information is reasonably necessary to:
If we receive a government or law enforcement request for customer data, we will promptly notify the customer and provide them with a copy of the request, unless we are legally prohibited from doing so. Further, we may challenge government or law enforcement requests for customer data that we consider to be overly broad or unlawful.
Rapid7 may share information internally across our parent, subsidiary, and affiliate companies or with third parties for the purposes defined in this policy. Information collected within the European Economic Area (“EEA”) and the UK may, for example, be transferred to countries outside of the EEA and the UK (including the United States of America) for the purposes as described in this policy.
When we transfer EEA and UK personal information to non-EEA/non-UK countries, we will implement appropriate safeguards to protect this information. This may include implementing the European Commission's Standard Contractual Clauses (available here) with our customers when we process personal information on their behalf.
With respect to personal data received or transferred pursuant to the Framework, Rapid7 is subject to the regulatory enforcement powers of the U.S. Federal Trade Commission. In compliance with the Privacy Shield Principles, Rapid7 commits to resolve complaints about our collection or use of your personal information. EEA and UK individuals with inquiries or complaints regarding our Privacy Shield policy should first contact us at email@example.com. Under certain conditions, more fully described on the Privacy Shield website, you may invoke binding arbitration when other dispute resolution procedures have been exhausted. Rapid7 complies with the Privacy Shield Principles for all transfers pursuant to the Framework of personal data from the EEA and the UK, including the onward transfer liability provisions.
We encourage you to periodically review this page for the latest information on our privacy practices.
Upon request, Rapid7 will provide you with information about whether we hold any of your personal information. You may access, correct, update or request deletion of your personal information by emailing us at firstname.lastname@example.org. We will respond to your request within a reasonable timeframe and in accordance with applicable data protection laws.
We may use your information to send you a newsletter or other marketing communications in accordance with your communication preferences. You may choose to stop receiving our newsletter or marketing communications at any time by following the unsubscribe instructions included in the newsletters or communications. Alternatively, you can opt-out of receiving such newsletters and communications by contacting us at email@example.com.
If you opt to end your engagement with Rapid7, you have the opportunity to collect and transfer any data that is possible to export. If you request that Rapid7 delete your data, the request will be processed in accordance with applicable law and regulation.
We're a security company, so naturally we take data security very seriously. We use appropriate technical and organizational security measures to protect your data against any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, the information we process.
If you are a customer, we will retain your information for as long as your account is active, or as needed to provide you products and/or services. If you wish to cancel your account or request that we no longer use your information to provide our offerings, contact us at firstname.lastname@example.org.
In all other cases, we will retain and use your information as necessary for legitimate business reasons, including as needed to comply with our legal obligations, to resolve disputes, and to enforce our agreements. When we have no ongoing legitimate business reason to process your information, we will either delete or anonymise it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your information and isolate it from any further processing until deletion is possible.
If you are an individual in the European Economic Area or the UK, our legal basis for collecting and using your information will depend on the information concerned and the specific context in which we collect it.
However, we will normally collect information from you only where we have your consent to do so, where we need the information to perform a contract with you, or where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms. Where we collect and use your information in reliance on our legitimate interests (or those of any third party), it will normally be obvious from the context what those legitimate interests are.
If we are processing information about you on behalf of a customer in the course of providing our services to them (i.e. as a data processor), then it is our customer's responsibility to determine the legal basis for the processing we conduct on their behalf. If you ask us about information we are processing on behalf of a customer, we will direct you to speak with the relevant customer.
If you have questions about or need further information concerning the legal basis on which we collect and use your information, please contact us using the contact details provided below.
In addition to your rights to access, correct, update and delete your information described above, and your right to opt-out of communications also explained above, you also have the right to object to processing of your information, ask us to restrict processing of your information or to request portability of your information. You can exercise these rights by contacting us using the contact details provided below.
If we have collected and process your information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your information conducted in reliance on lawful processing grounds other than consent.
If you are unhappy with the way we have processed your information, you have the right to complain to a data protection authority. For more information, please contact your local data protection authority. (Contact details for data protection authorities in the European Economic Area are available here.)
We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.
To contact our Data Protection Officer, please e-mail email@example.com.
Our representative in the UK is Rapid7 International Limited with a registered office at Riverbank House, 2 Swan Lane, London, England, EC4R 3TT.
Our representative in the European Union is Rapid7 Ireland Limited with a registered office at 70 Sir John Rogerson’s Quay, Dublin 2, Ireland.
Rapid7, 120 Causeway Street, Suite 400, Boston, MA 02114