Legal
Jetstone privacy policy
Version 2026-10-30
Black Shard Pty Ltd (ABN 66 696 910 773) makes Jetstone. This policy covers the personal information Jetstone handles. The Black Shard website has its own policy at blackshard.com.au/legal/privacy.
Who we collect information about
- Workspace owners and the people they invite to the console.
- People who use the devices a workspace enrols, and people whose Microsoft 365 accounts a workspace connects.
- People who contact us about Jetstone.
What we collect and why
| Information | Where it comes from | Why |
|---|---|---|
| Name, email address, workspace name | You, at signup and when you invite someone | To run your account and send sign-in codes, trial notices and incident alerts |
| Passkey public keys and sign-in records | Your browser or phone | To sign you in and keep a record of sign-ins for your workspace |
| Billing contact, billing address, card token | You, through Stripe Checkout | To bill the subscription. Stripe holds the card; we hold a reference to it |
| Device telemetry: process, file, registry, network, DNS and script activity, the signed-in Windows and Entra account, installed software and security settings | The Jetstone agent on each enrolled device | To detect attacks, write up incidents and take the response actions your policy allows |
| Microsoft 365 sign-in and audit records: account, time, IP address, country, client, mailbox rule and application consent events | Your Microsoft 365 tenant, after an administrator consents | To detect account compromise and take the account actions your policy allows |
| Quarantined files | Devices, when a file is quarantined | So the file can be restored if the quarantine is undone |
| Messages you send us | You | To answer them |
The agent does not read file contents, email bodies or documents. Command lines and script text are filtered on the device for credential patterns before they are sent.
Where it is held
Jetstone's service runs in Microsoft Azure, Australia East (New South Wales). Device telemetry, incidents, the console data, sign-in records and quarantined files are stored there. Incident write-ups are produced by a language model deployed in Black Shard's own Azure subscription in Australia East, from a redacted evidence pack; the model provider does not receive or keep the data. The residency page at /residency/ lists each store.
Who else processes it
| Processor | What they receive | Where |
|---|---|---|
| Microsoft (Azure) | Everything listed above, as our hosting provider | Australia East |
| Microsoft 365 and Microsoft Graph | Requests for your own tenant's records and the account actions your policy allows | Your tenant's Microsoft 365 geography |
| Microsoft 365 (Black Shard's tenant) | Sign-in codes and notices we email you, until email moves to the product domain | Australia |
| Stripe, Inc. | Billing contact, billing address, card details, subscription and invoice records | United States |
| Apple Push Notification service and Firebase Cloud Messaging | For the mobile app: a fixed notification sentence and an opaque id. No device, user, file or workspace name | United States and other locations those services use |
| Your mail provider | Emails we send you | Wherever your provider holds mail |
We do not sell personal information and we do not use it to train models.
How long we keep it
- Raw device telemetry: 12 months from receipt, in storage that cannot be altered or deleted during that period. It is deleted when the period ends.
- Detection hits: 90 days.
- Incidents, actions, audit records and account data: for the life of the workspace and 30 days after it closes.
- Billing records: five years, as Australian tax law requires.
Access, correction and complaints
You can ask for access to or correction of personal information we hold about you at info@blackshard.com.au. A workspace owner can export the workspace's records from the console.
If you are an employee whose device or account a business monitors with Jetstone, that business decides what is collected. Ask them first; we will help them answer you.
If you are unhappy with how we handled your information, email info@blackshard.com.au. We reply within 30 days. If you are still unhappy, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Notifiable data breaches
If a data breach is likely to result in serious harm, we notify the affected workspace owners and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.
Changes
We post changes here with a new version date and email workspace owners about any material change.