What we collect

• Account: your name, email address, a hashed password, your role, and your two-factor secret if you enable 2FA.
• Billing: invoice references, amounts, edition and period, and payment status. Card and bank details stay with the payment gateway you chose (PayFast or Stitch) — they never touch our servers.
• Licences and appliances: licence keys, edition, expiry and device limit; and per appliance — its installation ID, the hostname you chose for it, software version, device counts, licensing/heartbeat pings and integrity status. Your appliances send these to us so we can verify entitlements and show your fleet status.
• Support: whatever you send us — emails, support grant codes, and any diagnostics you choose to share.
• Threat telemetry: anonymous attacker IP addresses and block counts from your appliance — never your LAN addresses, device details or browsing data. You can switch this off in the appliance's threat feed settings.
• Technical logs: standard request logs (IP address, timestamps) via Cloudflare and our server, for security and abuse prevention.

Why we collect it

To issue and renew licences, verify entitlements, keep your fleet page current, process payments, email receipts, answer support requests, prevent abuse, and meet legal obligations. That’s the whole list.

Who we share it with

• PayFast — payment processing only.
• Stitch (express.stitch.money) — payment processing only.
• Cloudflare — DNS, CDN and attack filtering for netfortress.tech.
• Our email provider — transactional email (receipts, licence notices).
• We never sell or rent personal data, and we only disclose it when the law requires it.

Cookies

Only what keeps you signed in. No advertising or tracking cookies, on the site or in the appliance dashboard.

How long we keep it

• Account and licence data — while your account and licences exist.
• Billing records — as long as tax law requires.
• Technical logs — for a limited security window, then deleted.
• Close your account and we remove your data, keeping only what we must legally keep.

Security

Everything travels over TLS. Access inside our systems is least-privilege, secrets are hashed or encrypted at rest, and the appliance itself ships with a compiled, integrity-checked core — the same protection philosophy applies to us as to your appliance. Dashboard apps may also connect over plain HTTP when you point them at a local-network address on your own network — that traffic never leaves your LAN, and remote access always uses TLS with your appliance's certificate.

Data on your own appliance

Device inventories, policies and dashboards live on your appliance, in your building. They stay there apart from the licensing and heartbeat pings described above — and when remote monitoring is configured, the telemetry you choose to display is also transmitted to your own dashboard device (see the Dashboard apps section). Wipe the appliance and that data is gone.

Fleet threat intelligence

To make every appliance stronger, appliances share what attackers look like across the fleet:

• What is shared: the public IP addresses of external attackers your appliance has blocked or flagged (IDS alerts, dropped connections) with a count per address, plus your installation ID so a re-sent report is never double-counted.
• What is never shared: your LAN addresses, device names, users, browsing or business data. Private-network addresses are filtered out before anything leaves the appliance, and the server re-validates every entry.
• What you get back: addresses flagged across the fleet are combined into a community threat list that strengthens every installation.
• Control: the “Community threat intelligence” switch in the appliance's threat feed settings turns sharing off at any time; the firewall's protection never depends on it.
• Retention: per-appliance contribution records age out after 30 days; aggregated attacker totals are kept only while they remain useful.

NetFortress Dashboard apps

The NetFortress Dashboard apps (wallboards, monitoring displays and TV apps) connect to your infrastructure, not to us:

• Saved locally on the dashboard device: the server address you configure, pairing credentials, API tokens and your chosen layout are stored in the app's local storage on that device only and are never sent to NetFortress.
• Telemetry retrieved and displayed: device names, IP addresses, traffic statistics and security events are fetched from your appliance or management server and shown on screen. The app keeps no history beyond what is needed to draw the views you display.
• Connections: the app opens connections only to the management server and appliance you configure — never to third parties. Remote connections use your appliance's public hostname and certificate; local-network connections may use plain HTTP at your choice.
• Removing data: everything the app has saved — addresses, credentials, tokens and layouts — is removed by using the app's sign-out / forget option where available, or by deleting the app from the device. Uninstalling never touches data on your appliance.

Your rights

Access, correction, export, and deletion — email [email protected] from your account email and we respond within 3 business days.

Changes

We post changes to this page, and email account holders about material ones.