Privacy Policy

1. Who is responsible for your data

Invictus Academy is operated by Invictus Incident Response B.V. (“Invictus”). For the identity and performance data of trainees, your organisation is the controller - it decides to train its staff - and Invictus acts as its processor under a data processing agreement. Invictus is the controller for its own operation of the platform. If you are a trainee, your first point of contact is your organisation’s administrator.

2. What data we process

• Identity - your name, work email or user principal name, organisation, and role, provided through your organisation’s sign-on.
• Training performance - per-lab metrics such as time to detect and respond, your submissions, and results.
• Technical - an essential session cookie that keeps you signed in, and audit records of privileged actions that reference internal identifiers.

3. Why we process it, and our lawful basis

We process identity data to deliver the training service to you (the performance of the contract with your organisation). We process your training performance to measure and show your progress; this rests on legitimate interest in providing effective training. The transparency that interest depends on is provided by the platform itself rather than assumed of your employer: every figure an administrator can see about you is on a page you can open, and that page says who else can read it. Where a specific processing has no other basis, we rely on consent. We apply data minimisation throughout and use only what the training requires.

4. Who can see your performance

Reporting across cohorts uses aggregated figures that carry no identifier. Your own performance is not anonymous to your employer: the administrators of your organisation can open your progress page and see what you have completed and how accurate you have been. It is the same page you can open yourself, and your copy of it says so. This is not something you opt into and not something you can turn off, because it is why your organisation is training you.

Your colleagues see none of it unless you choose to appear on your organisation’s standing, which is off until you turn it on and which removes you the next time anybody looks after you turn it off. Individual runs, cases, evidence and grade reports stay yours: nobody else can open them, including an administrator.

5. Where your data is processed

Your personal data is processed and stored in the European Union. The platform and the stores that hold your data are in Microsoft's France Central region (Paris), which is inside the Microsoft EU Data Boundary. The lab environments, which are built on synthetic data, run in Microsoft's North Europe region (Ireland), also inside the boundary, and so does the gateway that connects the lab shell to them on a deployment that offers it. No environment or datastore is hosted in Ukraine. The Azure subscription the platform runs in is held by our consortium partner, Computer Forensics Lab LLC (CyberLab), so Microsoft is engaged as a sub-processor under CyberLab's Azure agreement, and CyberLab, as the holder of that subscription, is named as a sub-processor pending legal characterisation. Role-based access control bounds the platform's own components; it does not bound the subscription's administrators, who are a Ukrainian company's staff and can reach the data from Ukraine. Whether that is a transfer needing safeguards is a question we have put to counsel, and we say all of this here rather than imply otherwise. Where external time-anchoring of evidence integrity records is enabled on the production deployment, an external RFC-3161 timestamp authority is engaged on the same basis; it is not engaged where that control is off.

6. Lab data and anonymisation

Labs are built to be synthetic by default. Where a lab is derived from a real incident, the source material is anonymised inside an EU clean room - a network-isolated environment with no route to any range or to this platform - before it is published. Published labs are synthetic or verified-anonymised. Your identity as a trainee is kept separate from lab evidence and does not form part of it. Where a lab is opened in a cloud console, you sign in with a pseudonymous lab account of your own, created for you the first time you ask, from a lab or from your lab account page: a Microsoft Entra account in the directory of the Azure subscription named in section 5. The account carries neither your name nor your email address. It belongs to groups that say which collections of labs your organisation's plan includes, and those groups and the account's pseudonymous name are passed to AWS IAM Identity Center and Google Cloud Identity, so the same account signs you in to the AWS and Google Cloud labs on your plan. For each run it can read that lab's resources, and that access ends with the run. Microsoft records each sign-in to it, with the IP address it came from. The password and authenticator you register stay on the account until it is deleted: when you leave your organisation, when its plan no longer includes labs, or when the account goes 90 days unused. A deleted account is kept by Microsoft for thirty days before it is gone for good.

7. How long we keep it

Identity and performance data are kept for the duration of your organisation’s engagement plus a short contractual grace period, then deleted. Evidence retained by the platform is synthetic or verified-anonymised and is not your personal data.

8. Your rights

Subject to applicable law, you have the right to access your personal data and to request its rectification, erasure, or restriction, to object to certain processing, and to data portability. Because your organisation is usually the controller, please raise requests through it; we support controllers in responding. You also have the right to complain to a data protection supervisory authority - in the Netherlands, the Autoriteit Persoonsgegevens.

9. Cookies

The platform uses only essential and functional first-party cookies - one to keep you signed in securely, and a couple to remember your own settings. None is used for advertising, analytics, or cross-site tracking. The Cookie Policy lists each one, why we use it, and how long it lasts.

10. Changes to this policy

We may update this policy; the date above shows the latest revision. For material changes we will make reasonable efforts to notify you or your organisation.

11. Contact

For privacy questions, contact your organisation’s administrator or Invictus Incident Response B.V., Weena 690, 3012 CN Rotterdam, the Netherlands. See also the Terms of Service.