Privacy Policy

1. Who this policy applies to

This policy applies to:

• Visitors to soxlayer.com.
• Customers, meaning the companies and advisory firms that subscribe to SOXLayer.
• Users, meaning the individuals a Customer invites to use SOXLayer, such as control owners, preparers, reviewers, and administrators.

2. Our role: controller and processor

Account, billing, and website data. For information about who you are, how you sign in, how you pay, and how you use our website, CUEDEV is the controller of that information.

Customer Content. Customers upload control matrices, test evidence, workpapers, comments, and related files into SOXLayer ("Customer Content"). For Customer Content, CUEDEV acts as a processor (or "service provider") on behalf of the Customer. The Customer decides what goes into SOXLayer and is responsible for having the right to share it with us. If you are a User and have questions about Customer Content, please contact your organization first. We will process Customer Content only to provide the Service and as instructed by the Customer.

3. Information we collect

3.1 Information you give us

• Account information: name, work email address, job title, company name, and password.
• Organization information: company and entity names, team structure, and user roles.
• Customer Content: controls, test procedures, evidence files, test results, reviewer sign-offs, deficiencies, remediation notes, and comments.
• Billing information: name, billing email, billing address, and tax details. Payment card details are collected and processed directly by our payment provider, Lemon Squeezy. We never see or store your full card number.
• Communications: messages you send us by email or through the Service, including demo requests and support requests.

3.2 Information collected automatically

• Usage and log data: IP address, browser type, device type, pages visited, actions taken in the Service, timestamps, and error logs.
• Audit trail data: records of who created, edited, approved, or deleted items in the Service and when. This is a core feature of SOXLayer and is kept as part of Customer Content.
• Cookies and similar technologies: see Section 8.

4. How we use information

We use information to:

• Provide, operate, and maintain the Service, including user accounts, testing calendars, reminders, and workpaper exports.
• Generate AI-drafted test results and workpapers when you use those features (see Section 5).
• Send transactional emails such as invitations, sign-in and security messages, test reminders, and overdue alerts.
• Process subscriptions, free trials, payments, and refunds.
• Provide customer support and respond to your requests.
• Protect the security and integrity of the Service, detect fraud and abuse, and enforce our Terms and Conditions.
• Understand how visitors use our website so we can improve it.
• Comply with legal obligations.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

5. Artificial intelligence features

SOXLayer uses large language models provided by Anthropic and OpenAI to draft test results, conclusions, and workpapers from the evidence you provide.

• No training on your data. Customer Content is never used by CUEDEV to train AI models. We use these providers through their commercial APIs, under terms that prohibit them from using our API inputs and outputs to train their models.
• Limited sharing. Only the content needed for the specific task you request is sent to the AI provider.
• Human review. AI output is a draft. No test is marked as passed or concluded in SOXLayer without sign-off by a named human reviewer.

6. How we share information

We share information only as described below.

6.1 Service providers (subprocessors)

We use the following providers to run the Service. Each is bound by contractual obligations to protect the information and use it only to provide services to us.

We may update this list as our Service changes. Customers may request advance notice of changes to subprocessors by writing to team@soxlayer.com.

6.2 Within your organization

Customer Content and user activity are visible to other Users in the same Customer account according to the roles and permissions set by the Customer's administrator. Customer data is logically isolated per Customer and is not visible to other Customers.

6.3 Legal and safety reasons

We may disclose information if we believe in good faith that it is required by law, subpoena, or court order, or that it is necessary to protect the rights, property, or safety of CUEDEV, our Customers, or others. Where legally permitted, we will notify the affected Customer before disclosing Customer Content.

6.4 Business transfers

If CUEDEV is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

7. Security

We use administrative, technical, and physical measures designed to protect information, including:

• Passwords and credentials are never stored in plain text. They are stored using one-way cryptographic hashing (SHA-256).
• Data is encrypted in transit using TLS and encrypted at rest.
• Customer data is logically isolated per tenant.
• Access to production systems is limited to authorized personnel who need it.
• The Service keeps audit logs of user activity.

No system is completely secure. If we become aware of a security incident affecting your personal information or Customer Content, we will notify affected Customers without undue delay and as required by law.

8. Cookies and analytics

We use cookies and similar technologies for:

• Essential purposes: keeping you signed in, security, and remembering your preferences. The Service cannot work without these.
• Analytics: Google Analytics on soxlayer.com, to understand how visitors find and use our website. Google Analytics collects information such as pages visited, time on page, and approximate location derived from IP address.
• Usage analytics and session recordings: Microsoft Clarity on soxlayer.com, to see how visitors use our website and where they get stuck. Clarity records clicks, scrolling and page interactions; text typed into form fields is masked before it leaves your browser. Clarity is not used inside the Service. See the Microsoft Privacy Statement.

You can block or delete cookies in your browser settings, and you can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on at https://tools.google.com/dlpage/gaoptout. Blocking essential cookies may prevent you from signing in.

We do not use advertising cookies.

9. Data retention

• Customer Content and account data are kept for as long as the Customer's subscription is active.
• After cancellation or termination, the Customer has 30 days to export its data. After those 30 days, we delete Customer Content and associated account data from our active systems. Residual copies in backups are deleted in the normal backup rotation.
• Billing records are kept for as long as required for tax, accounting, and legal purposes.
• Website analytics data is kept according to our Google Analytics retention settings.

10. Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate personal information.
• Delete your personal information.
• Receive a copy of your personal information in a portable format.
• Object to or restrict certain processing.
• Withdraw consent where processing is based on consent.
• Opt out of the sale or sharing of personal information. We do not sell or share personal information in this way.

To exercise these rights, email team@soxlayer.com. We will respond within the time required by applicable law, and we will not discriminate against you for exercising your rights. We may need to verify your identity before acting on your request.

If your request concerns Customer Content that your organization controls, we will refer your request to that Customer and assist them in responding.

10.1 California residents

Under the California Consumer Privacy Act, as amended, California residents have the rights listed above. In the past 12 months we have collected the categories of information described in Section 3, for the purposes described in Section 4, and disclosed them to the categories of recipients described in Section 6. We do not sell or share personal information and have not done so in the past 12 months. You may use an authorized agent to submit a request on your behalf.

10.2 Users in the European Economic Area, United Kingdom, and Switzerland

Where the GDPR or UK GDPR applies, we rely on the following legal bases: performance of a contract (to provide the Service), legitimate interests (to secure, support, and improve the Service), consent (for analytics cookies where required), and legal obligation. You may lodge a complaint with your local data protection authority.

11. International data transfers

CUEDEV is based in the United States, and our service providers process data in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. A Data Processing Addendum is available to Customers on request at team@soxlayer.com.

12. Children

The Service is designed for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify Customers by email or through the Service before the changes take effect, and we will update the "Last updated" date above.

14. Contact us

CUEDEV LLC
30 N Gould St, Ste R
Sheridan, WY 82801
United States

Email: support@soxlayer.com or team@soxlayer.com