1. Privacy and Data Protection Policy (GDPR / ARCO)

SISSA guarantees maximum confidentiality and protection in the processing of personal data belonging to its clients, partners, collaborators, and visitors.

• Legal Basis and Scope: We strictly comply with the European Union General Data Protection Regulation (GDPR), Personal Data Protection Laws in Possession of Private Parties (ARCO Rights), and ISO/IEC 27001 international standards.

• Information Collection: All technical, biometric, operational, or contact information collected through our digital portals, Global Security Operations Centers (GSOC), or encrypted communication channels is processed under the principles of lawfulness, fairness, transparency, and storage limitation.

• Use of Information: Collected data is used exclusively for risk assessment, protection service delivery, corporate intelligence analysis, security audits, and background verification based on consent or legitimate interest.

• Exercise of Rights (ARCO / GDPR): Data subjects may at any time exercise their rights of Access, Rectification, Cancellation, Opposition, Portability, and Restriction of Processing by submitting a formal request to our Data Compliance Officer.

• Encryption and Security: Sensitive information gathered during our operations is stored under military-grade encryption protocols (AES-256 in transit and at rest), guaranteeing that it will not be sold, transferred, or exposed to unauthorized third parties.

2. Terms of Service and Legal Notices

Access to and use of SISSA's digital platform and corporate services are subject to the following regulatory conditions:

• Regulatory Status and Licensing: SISSA operates as a risk management, intelligence, and executive protection firm duly accredited, registered, and authorized by public security and defense authorities in the jurisdictions where it maintains operational deployment.

• Nature of Results: Our services are based on best efforts, not guaranteed outcomes. We apply structured methodology and professional good faith, but we do not guarantee the recovery of an amount, the location of a person or asset, or a specific judicial outcome. The benefits described on this site are service objectives, not promises.

• Limitation of Liability: This site is strictly informational, and its use does not establish any contractual relationship with SISSA. To the maximum extent permitted by law, SISSA assumes no liability for the use made of the site or its content, nor for interruptions, errors, viruses, or damages resulting from access to it, nor for the content of linked third-party sites, which are provided solely for convenience. The engagement of any SISSA service, as well as the responsibilities, scope, and other derived formalities, shall be agreed upon exclusively in the service contract signed for that purpose.

• Intellectual Property: All graphic material, intelligence methodologies, registered trademarks (including the typographic mark and the three-dimensional shield emblem), security architecture designs, and website code are the exclusive property of SISSA. Partial or total reproduction without prior written authorization is strictly prohibited.

• Technical Information and Intelligence Reports: Technical information and intelligence reports published on this website are for informational purposes only. Definitive risk assessments require a formal analysis signed by our certified auditors and consultants.

• Acceptable Use: Using our digital channels for reverse engineering, unauthorized vulnerability scanning, identity spoofing, or any action that compromises the integrity of our technological infrastructure is strictly prohibited.

• Service Contracting: No services are delivered through the site. Each service is governed by a signed contract or proposal defining scope, deliverables, fees, timelines, and confidentiality. If that contract contradicts these terms, the contract shall prevail.

• Legal Actions: SISSA reserves the right to pursue any corresponding civil, criminal, or administrative legal actions against any individual or legal entity, regardless of nationality, domicile, or residence, that misuses the site to the detriment of SISSA or any other individual or legal entity. This includes filing reports with competent authorities in the relevant jurisdiction.

• Services SISSA Does Not Accept: We reserve the right to decline any engagement.

• Modifications: We may update these terms at any time. The current version is the one published on this page.

3. Anti-Corruption, Compliance, and Anonymous Ethics Hotline Policy

SISSA maintains a Zero Tolerance policy against any form of corruption, bribery, extortion, money laundering, or unethical business practices.

• Regulatory Compliance Framework: Our global operations are governed by the standards of the US Foreign Corrupt Practices Act (FCPA), the UK Bribery Act, ISO 37001 (Anti-Bribery Management Systems), and the guidelines of the Financial Action Task Force (FATF / GAFI).

• Relationship with Public and Private Entities: No SISSA employee, operational agent, or representative is authorized to offer, promise, deliver, or solicit improper payments, gifts, or favors to public officials or private executives to secure operational advantages.

• Ethics Channel and Anonymous Reporting: We maintain an independent reporting platform managed by a neutral third party to receive reports regarding potential violations of our Code of Ethics or unlawful acts.

• Non-Retaliation Guarantee: We guarantee absolute anonymity for whistleblowers and a strict zero-retaliation policy for those who report irregularities in good faith.

4. Information Security Disclosure (Vulnerability Disclosure)

At SISSA, cybersecurity and digital resilience are fundamental pillars. We value the work of the security research community and encourage the responsible identification and disclosure of vulnerabilities across our platforms.

• Commitment to Protection (Safe Harbor): We will not initiate legal action or notify authorities against security researchers who act in good faith, adhere to the guidelines of this policy, and do not compromise the privacy or availability of our clients data.

• Program Scope (In-Scope):

  • Official SISSA domains and subdomains (*.sissa.solutions).

  • Company client portals and public API interfaces.

• Prohibited Conduct (Out-of-Scope):

  • Denial of Service attacks (DoS / DDoS).

  • Social engineering practices, phishing, or spam targeted at SISSA personnel.

  • Unauthorized access, alteration, or destruction of client operational data.

• Reporting Process and Response Times:

  • Submit your detailed findings (including proof of concept) to our Cybersecurity Incident Response Team (CSIRT).

  • Acknowledgment of receipt: Within 24 hours of receiving the report.

  • Evaluation and remediation: Commitment to priority patching or mitigation within 72 hours for critical vulnerabilities.

POLICIES

HOME

HOME