Data Processing, Security, and Compliance
Last Updated: August 4, 2026
SecurePoint USA LLC, a Washington limited liability company ("SecurePoint," "we," "us," "our"), provides compliance, visitor management, screening, and audit logging software and related services (the "Services"). This Privacy Policy explains how we collect, use, share, and protect information when you visit our websites or use our Services.
If you have questions, contact us at privacy@securepointusa.com.
This Privacy Policy applies to:
This policy does not cover third party websites or services that we do not control.
SecurePoint generally acts as a data processor when we process information on behalf of an organization that uses our Services (the "Customer"). In those cases, the Customer is the data controller and determines how personal data is used.
SecurePoint acts as a data controller for information we collect directly from visitors to our websites, and for business contact data for sales and support.
To provide screening and compliance capabilities, we ingest and maintain sanctions, restricted-party, and related compliance datasets from public sources and, where applicable, partner or third party data sources. We store these datasets in our systems so screening can continue even if an external source is temporarily unavailable.
We do not publish in this policy the size or count of any dataset.
We use information to:
Our default approach is to perform screening against datasets stored within our systems that we maintain by ingesting source data over time.
If a Customer enables optional integrations that require sending data to a third party (for example, messaging providers, identity verification, or other tools), we share only the minimum necessary information to provide that integration.
We do not sell personal information.
Depending on your location and relationship with us, we process personal data based on:
SecurePoint stores and processes customer data in the United States.
We do not offer non-US data residency, and we do not move customer data outside the United States for processing, storage, or backup.
Provider support personnel. Our infrastructure providers operate global support organizations, and we do not represent that every individual with platform-level access at those providers is located in the United States. That access is at the infrastructure level rather than role-based access to a Customer's tenant through the Services. Customer data is encrypted at rest, tenant data is isolated at the database layer, and privileged administrative actions are recorded to an audit trail.
If your organization has United States personnel or data residency requirements, raise them during contract review so the applicable commitments can be set out in the agreement.
We use administrative, technical, and physical safeguards designed to protect information, including:
No system is perfectly secure. Customers are responsible for configuring their accounts securely (for example, strong passwords, MFA, and proper role assignments).
Retention depends on the context:
Customers may request deletion of Customer data subject to contract terms, legal requirements, and security needs (for example, preserving audit trails).
Depending on your location, you may have rights to:
If you are a visitor or end user interacting with a Customer's deployment, direct requests to the Customer (the controller). We will assist Customers in fulfilling requests as required by contract and law.
To request help directly from SecurePoint for website or business contact data, email privacy@securepointusa.com.
Our marketing site and our direct commercial relationships are intended for adults acting on behalf of an organization. We do not market to children and we do not knowingly collect personal information from a child for our own purposes.
A Customer may nonetheless submit information about a minor to the Services. Two cases are common: an educational institution may submit data relating to a student, and a person under 18 may be checked in as a visitor at a Customer site. In those cases we act as a service provider processing on the Customer's documented instructions, and the Customer remains the controller.
Where an institution has designated us a school official with a legitimate educational interest under 34 CFR § 99.31(a)(1)(i)(B), we use education records only for the authorized purpose and do not redisclose them except as FERPA permits and the institution authorizes. Where the Children's Online Privacy Protection Act or a state student data privacy law applies, we process on the institution's instructions and rely on the consent or authorization the institution is responsible for obtaining. The specific terms are set out in the applicable agreement.
If you believe a child's information reached us outside a Customer relationship, contact privacy@securepointusa.com and we will delete it. Requests concerning information a Customer submitted should be directed to that Customer.
We may update this Privacy Policy from time to time. We will update the "Last updated" date and may provide additional notice where appropriate.
SecurePoint USA LLC
Email: privacy@securepointusa.com
© 2026 SecurePoint USA. All rights reserved.
