Privacy notice

Who we are

Aramis is operated by Nearshore Cyber USA, LLC, a Texas limited liability company, with its address at 539 W. Commerce St. #7447, Dallas, Texas 75208, USA. We are the controller of your personal data (the responsable, under Mexican law). For anything in this notice, write to contact@project-aramis.com.

Nearshore Cyber also runs consulting services and study cohorts. Those are separate from your assessment. Your Aramis data is never used for them unless you give a specific, separate consent that you can withdraw, and refusing costs you nothing.

What we hold

This is everything we hold about you.

• Your email address, and your name if your sign-in provider gives us one.
• If you sign in with Google, Microsoft, or LinkedIn, that is where the email and name come from. The access and refresh tokens the provider issues are discarded the moment sign-in completes. We never store them, so there is nothing there to leak and nothing to delete later.
• Your answers: which option you chose on each question, whether it was correct, and how long the question was on screen. We use timing to judge whether a question works well. It never affects your score.
• Your self-assessment ratings, and the competency map computed from all of the above.
• Your IP address, recorded against your sign-in session and against security-relevant actions. We keep it to detect account abuse. It is personal data.
• Your consents: each one you grant or withdraw, when, and on which screen. The record of a refusal is kept too, so that a later change of mind shows up as one.
• Your preferences: language, whether you want progress emails, and whether you want your competency map by email after a round you finish.
• If you use Study (the learning side of a role you have measured in two finished rounds, or answered 48 of its questions): which Study questions you answered and acknowledged, the confirmed time zone you gave us, and the Study days, goals, and planned days off computed from them. Study answers are kept entirely apart from your assessment answers; nothing you do in Study changes your competency map or any result.
• If you use Career Explorer: your interest responses and your responses to its small work samples, and the direction computed from them. These never enter any assessment, result, or employer view.
• If you use Aramis:Current Daily: your answers to its next-day quiz questions, and any feedback you give on an item it recommended.
• Your confirmed time zone, which you give us; we never work it out from your location or network. It exists only so Study can keep its history by your local day, and it never blocks anything else you do here.
• Any feedback you send us on a question, on why you stopped an assessment, or on the glossary, and any product suggestion you sign with permission to contact you (a suggestion sent without that permission is not linked to you).
• If you use the Requisition Compiler on behalf of an employer: the requisition text you paste, the title and outcome you enter, every decision you record, the Requisition Contract compiled from them, your acceptance of the Aramis:Build employer terms, and, for a contract you export, a record of whether and when your contact details were passed to our recruiting system (below). These are kept with your account until you delete it.
• If you use an Aramis:Build tool: whether your email address is a business address, which we work out from the address itself each time and do not store. To decide whether you have confirmed that you read that mailbox, we use Google's or Microsoft's confirmation of your address, or the record we keep each time you sign in with one of our emailed links. If you ask us to review a refusal, we hold your request (your address, its domain, and the note you write) and our decision on it, with who made it, when, and why.
• If you send the Aramis:Build inquiry form, with or without an account: your name, work email, company, title, team size, and message, the language of the page you sent it from, whether the anti-bot check passed, and where we are in answering you.
• If an employer invites you to an Aramis:Build campaign: the work address it entered, the invitation and its status; once you join, the account and assessment it is linked to, when you started and finished, your consent to be counted in the organization's aggregate results and, only if you tick its separate box, your consent for us to contact you about that organization's invitations. You can withdraw either consent from your dashboard; withdrawing the first drops you from every future aggregate. The employer never receives your individual result.
• If you administer an Aramis:Build organization: your membership in it (your role and when you joined) and the campaigns and invitations you create.
• If a recruiter invited you to take an assessment: the invitation itself (the email address and name the recruiter gave us, the role, and its status), and for each result summary sent back to that recruiter, a record of what was sent, when, and under which consent.
• If a result summary was sent to Nearshore Cyber's recruiting system without an invitation (the second case under "What an employer can and cannot see"): a record of which assessment it was, when it was sent, and the candidate record it went to.
• We never hold a password. Aramis has no password: you sign in by an emailed link or through a provider. The field exists in the software we use and is never filled.
• We do not ask for, and do not knowingly hold, sensitive personal data (health, beliefs, ethnicity, biometrics, sexual orientation, or the equivalent under LFPDPPP Art. 2, section VI and GDPR Art. 9).

Why we hold it

Primary purposes. These are what the service is. You cannot refuse them and still have an account, because without them there is no assessment: creating and securing your account, delivering the questions, computing your results, answering your support requests, and meeting our legal obligations. Our lawful basis under GDPR is performance of the contract you entered by signing up (Art. 6(1)(b)) and, for security and legal duties, our legitimate interests and legal obligations (Art. 6(1)(f) and (c)).

Keeping the questions honest. We may run automated checks over answer records to find assessment rounds whose data would distort the statistics we use to calibrate the questions: for example two rounds from one account at the same instant, or answer patterns that match across accounts beyond chance. Timing alone never triggers anything. We do not use a camera, microphone, keystroke logging, clipboard or tab monitoring, device fingerprinting, precise location, or any artificial-intelligence cheating detector, and a shared network or VPN never produces a finding about you. The only possible outcome is a human-reviewed decision to leave one round out of the statistics; it can never change your results, your map, your Study access, or your account, and you are told about it and can contest it. Lawful basis: our legitimate interest in accurate calibration (Art. 6(1)(f)). As of this notice no such check is running; we describe it here in advance.

Aramis:Build inquiries. If you send the inquiry form, we use what you wrote to answer you and, if the conversation goes further, to take the steps you ask for before you start using Aramis:Build. Our lawful basis is taking steps at your request before a possible contract (Art. 6(1)(b)) and our legitimate interest in answering a business inquiry (Art. 6(1)(f)). We do not add your address to any mailing list, and we do not use an inquiry for the assessment. We keep an inquiry for 24 months after our last exchange about it, and we delete it sooner if you ask. An inquiry sent from the email address of your Aramis account is also deleted when you delete that account.

Secondary purposes. Each is optional, each is refusable, and refusing does not degrade the assessment in any way. Under GDPR these run on your consent (Art. 6(1)(a)), which you can withdraw at any time.

• Progress emails about assessments you have not finished. Off unless you ask for them. You can pause them for a week or stop them permanently from any email, without signing in.
• Your competency map by email: one message after each round you finish, with the areas measured and one line per area, only if you ask for it from your results page. A separate consent from progress emails. Stop it from any of those emails, without signing in, or from your results page.
• One Study reminder a day, at 8:00 p.m. in your confirmed time zone, only on days you have not studied and only if you ask for it. A separate consent from progress emails; one never turns on the other. No second message, no countdown, no tracking of whether you opened it.
• Improving the questions. Your answers feed the statistics that tell us which questions work. When a round finishes, its answers are added to per-question totals (how many times each question was answered and how many of those answers were correct) that carry no link to you or to the round. Those totals remain after you delete your account; your answers themselves do not. See "When you delete your account" below.
• Study-cohort reporting, if you join a cohort. Separate consent, separately withdrawable.
• Contact about Nearshore Cyber consulting work. Separate consent, off by default, and joining a study cohort never enrolls you in it.

What an employer can and cannot see

Aramis:Build is free today. Its aggregate map runs as a pilot: Nearshore Cyber sets up each employer's organization and its administrators, and the employer's administrators create the campaigns. If your employer runs an Aramis:Build campaign and you join it, the employer decides whom to invite, and Nearshore Cyber runs the assessment and computes the team aggregate on the consent you give us directly. The employer sees the shape of the team in aggregate, how many people have completed each role, and which of its invitations are still waiting. It does not see your individual result, and it cannot ask us for it: the product does not have a screen that shows one named person's result to an employer.

Recruiting is the one exception. Nearshore Cyber runs its own recruiting in RecruiterFlow, an applicant tracking system, and a summary of your result can go to your applicant record there in two cases, and only for one of our recruiting assessments (today SOC Analyst (Splunk) and Azure Security Architect). First, a recruiter sent you an assessment invitation, you agreed to share on its consent page, and you finished that assessment before the invitation expired. You can withdraw that consent, and nothing is sent after you do. Second, without any invitation: you finished the whole of one of these assessments yourself, answering all of its questions, and the email address you signed in with matches exactly one candidate record in Nearshore Cyber's RecruiterFlow. This applies whether or not a recruiter asked you to take it. Nothing is sent for any other role, for a first round or a partly finished assessment, for an assessment the system closed on your behalf, or when your address matches no candidate record or more than one. In the first case, the summary contains the role, the date, how many questions you answered, and your correct-answer counts by area, and never how long you took, any integrity or authenticity analysis, or a hiring recommendation. In the second case, when you are a candidate in one of Nearshore Cyber's open searches, the summary can also include your percentage by area, how long you spent on the questions, a rule-based estimate of the likelihood that the answers were not your own work, a suggested next step for the interview, and a candidate rating from 1 to 5 set by a fixed rule; otherwise it is the same summary as in the first case. Outside these two cases and the team aggregate above, we send your assessment to no one; if you want someone else to see it, you send it to them yourself.

Who else touches your data

We do not sell your personal data. We do not share it for cross-context behavioral advertising. We do not run advertising, and our emails contain no tracking pixels. The only analytics on the site is the optional, consent-based measurement described under Cookies and tracking, and it never runs unless you say yes.

These providers process data on our behalf, only to run the service:

• Google Cloud (United States): hosting and the database. All of your data lives here.
• Resend (United States): sending sign-in links, the emails you asked for, and two alerts to Nearshore Cyber's own mailbox. When an employer exports a Requisition Contract, the alert carries the contract's working title, its number of units, its language, and a link to it in our back-office, never the requisition text; it does not depend on contact consent, so it is sent even if you have withdrawn that consent. When someone sends the Aramis:Build inquiry form, the alert carries the company name, the form's language, and whether the anti-bot check passed, never the message or the contact details.
• Cloudflare (United States): serves the site and runs the anti-bot check on the sign-in and contact forms. It sees your IP address in the course of doing that.
• Google, Microsoft, and LinkedIn: only if you choose to sign in with them, and only to sign you in.
• RecruiterFlow (United States), the applicant tracking system Nearshore Cyber runs its own recruiting in. Two things can reach it, and nothing else. First, the recruiting result summary, only in the two cases described under "What an employer can and cannot see". Second, if you export a Requisition Contract as an employer and have not withdrawn contact consent, your name, work email address, the organization implied by that address, and the working title of the position, so that we can follow up with you; never the requisition text or the contract itself. Withdrawing contact consent from your dashboard stops any further transfer.

Where your data lives, and who Aramis is for

Your data is stored in the United States, on Google Cloud. Nearshore Cyber USA, LLC is a US company and there is no European establishment.

Aramis is offered to cybersecurity professionals in the United States and Mexico. We do not target the European Economic Area or the United Kingdom: we do not advertise there, we do not price in euros or pounds, and the service is published in English and Mexican Spanish only. If you are in the EEA or the UK and choose to use Aramis anyway, you are welcome, but you should know that we are a US company holding your data in the United States, and you should decide with that in mind.

If you are in Mexico: your data is held by us in the United States and processed on our behalf by Google Cloud as our encargado. Under Mexican law a communication of data to an encargado who processes it for us is a remisión, not a transferencia to a third party, and it does not require your separate consent. Google does not, and may not, use your data for its own purposes.

We do not sell your data, to anyone, anywhere. That does not change with your country.

Cookies and tracking

Visiting Aramis sets no analytics or other optional cookies until you make a choice. Cloudflare, which serves the site, may set a strictly necessary security cookie when its security check runs. The banner on your first visit asks one question: whether we may use Google Analytics to understand how the site is used. If you decline, or close the banner without answering, no analytics loads and no analytics cookie is set. You can verify this in your own browser: decline, reload, and look.

When you sign in we set one cookie, which is what keeps you signed in. That is its only purpose and it is deleted when you sign out.

If you switch between the light and dark themes, we set one cookie, and a matching entry in your browser's storage, that record only the theme you chose. They hold no identifier and last a year, and clearing your browser's data for this site removes them.

When you start an assessment we set one more, which records only that you have been here before. It holds no identifier and nothing about you or your answers. It exists so that if you come back later and are signed out, the home page can offer to sign you back in rather than inviting you to start over. It lasts a year, and clearing your cookies removes it.

If you accept, Google Analytics sets its cookies and shows us aggregate usage: which pages are visited, from what kind of device, roughly where. We use that to improve the product and for nothing else. Your assessment answers and your results are never sent to Google. You can change your mind at any time with the cookie preferences link in the footer, and analytics stops.

There is no advertising anywhere in Aramis, and our emails contain no tracking pixels.

Your rights

Wherever you are, you can ask us to show you your data, correct it, delete it, or send you a portable copy. Write to contact@project-aramis.com. Some consents can also be withdrawn without writing to us: from the link in the emails a consent covers, from the cookie preferences link in the footer, from your results page (the competency-map email and a recruiting consent), and from your dashboard (Aramis:Build contact, and the consents you gave when you joined an Aramis:Build campaign).

If you are in Mexico, the LFPDPPP (published 20 March 2025) gives you ARCO rights: acceso, rectificación, cancelación y oposición. We will tell you our decision within 20 business days of your request, and if we grant it we will act within 15 business days after that. Since 21 March 2025 the authority for personal data held by private parties is the Secretaría Anticorrupción y Buen Gobierno, which took over the functions of INAI when INAI was dissolved. You may complain to it if we get this wrong.

If you are in the EEA or the UK, you also have the rights to restrict or object to processing, and to complain to your national supervisory authority.

If you are in California, you have the rights to know, delete, correct, and to opt out of sale or sharing. We do not sell or share your personal data, so there is nothing to opt out of.

We do not make decisions about you by automated means that produce legal or similarly significant effects. Your competency map is computed by simple arithmetic. It reaches an employer only inside a team aggregate you agreed to join, and a recruiter only through the recruiting summary described above. If that ever changes, this notice changes first.

When you delete your account

Your account, your email address, your name, and the link between you and everything you did here are deleted. So is anything you typed in free text: why you stopped an assessment, what you told us about a question, what you said in a survey, a product suggestion you signed. One exception: a correction you sent us about the glossary is kept without the link to you, because it is about a word, not about you; if you want it gone too, say so in the same request.

Your answers, your scores and competency maps, and your self-assessment ratings are deleted with your account. What remains of your assessments carries no link to you: the per-question totals your finished rounds were added to (how many times each question was answered and how many of those answers were correct); a bare record of each round you started (the role, the set of questions, the language, its status and dates, and the test group it was assigned to) with no answers and no score in it; and the categories you picked when you reported a question or stopped an assessment, and any survey ratings you gave, without anything you typed.

Everything you did in Study and Career Explorer, your time zone, your goals and planned days, and the record of which reminder emails we decided about are deleted with your account outright; nothing from them survives.

If a round of yours had been left out of the question statistics by the review described under "Why we hold it", the record that it was left out would remain, with no link to you, because it describes the quality of that round's data rather than you, and deleting it would put data known to be distorted back into the statistics. We would keep that record under GDPR Art. 17(3)(d), with the safeguards for statistical purposes in Art. 89(1). No such review has run, so no such record exists today.

We also keep what we must: records of suppression (so that an unsubscribed address stays unsubscribed, which requires remembering the address) and security logs we are obliged to retain.

Your compiled requisitions are deleted with your account. A recruiter's invitation to you keeps only that an invitation existed for a role and what became of it; your email address, name, and result summary are removed from it, and the record of what was sent to the recruiting system about you is deleted. What already reached RecruiterFlow is the recruiter's own record and is handled under their retention; write to us and we will ask for its removal.

For Aramis:Build: an inquiry sent from your account's email address is deleted with your account, and so is any request you made for a review of your business email; a review decision we recorded about your address keeps the decision and its reason, with your address removed. An inquiry sent from another address is deleted when you ask. If you joined an Aramis:Build campaign, your consents are deleted, so you leave every future aggregate, and the campaign keeps a record that an invitation existed, what became of it and when, without your address; if you finished the assessment, it still counts in the campaign's number of completed assessments. If you administer an Aramis:Build organization, your membership in it is deleted. An invitation you never accepted keeps the address the employer entered; write to us and we will remove it.

The two alert emails described under "Who else touches your data" stay in Nearshore Cyber's mailbox with no set deletion date, and deleting your account or an inquiry does not delete them. If you ask, we remove them from the mailbox.

If something goes wrong

If there is a security breach that significantly affects your rights, we will tell you, and we will tell the relevant authority. In Mexico that is the Secretaría Anticorrupción y Buen Gobierno. In the EEA and the UK we notify the supervisory authority within 72 hours of becoming aware, as GDPR Art. 33 requires.

We will tell you what happened, what data was involved, and what we are doing. We will not hold the notice back while we work out the full story.

Children

Aramis is for working cybersecurity professionals. It is not for children, we do not knowingly collect their data, and if we learn we have, we delete it.

Changes to this notice

If we change this notice in a way that affects what we do with your data, we will tell you by email before the change takes effect, and we will say what changed.

The date at the top of this page is the date of the last change.