Norton Creek Endpoint & Network Security LLC
Privacy at Norton Creek
We are an incident response firm, so we spend our days looking at what happens when data is handled carelessly. This page explains what this website collects, what happens to evidence you share with us, and how Virginia law shapes both.
This website
The site consists solely of pre-rendered incident runbook files with zero login, no contact form, no analytics script, no advertising pixels and no cookies of our own. The recovery calculator runs entirely in your browser; the numbers you type never leave your device.
Two outside parties still see your visit. Our hosting provider records standard request data (IP address, time, requested page, browser string) to deliver pages and fend off abuse, and keeps it for up to 30 days. Typefaces load via remote font stylesheets, which means the stylesheet host logs the requesting client socket and browser details when the fonts download. We do not receive or combine either set of data with anything else.
When you write to [email protected] or [email protected], we keep the message, your address and anything you attach so we can answer and, if you become a client, document the engagement. Messages that never turn into work are deleted after two years. Please do not email passwords, malware or protected health information; we will arrange a secure transfer.
Evidence from engagements
During an incident we may collect disk images, memory captures, logs and packet captures that contain personal data about your staff, customers or patients. That material is governed by our signed engagement letter, not by this page. In summary: it is stored encrypted on systems we control, used only for the investigation you authorized, never shared without your written consent or a lawful order, and destroyed or returned at the end of the retention period the engagement letter sets. For HIPAA-covered clients we sign a business associate agreement before any protected health information reaches us.
Virginia law
The Virginia Consumer Data Protection Act (Va. Code § 59.1-575 and following) applies to businesses above certain data-volume thresholds, which a firm of our size does not meet. We honor its rights anyway. You may ask what personal data we hold about you, ask us to correct or delete it, and ask for a copy in a portable format. We do not sell personal data, use it for targeted advertising or profile anyone.
If a breach of our own systems exposed your personal information, we would notify you and, where required, the Office of the Attorney General, as Va. Code § 18.2-186.6 requires.
Asking us
Send privacy questions or requests to [email protected] with “privacy” in the subject, or write to Norton Creek Endpoint & Network Security LLC, 11951 Freedom Dr, Suite 420, Reston, VA 20190. We answer within 45 days and will tell you if we need to confirm your identity first. If we decline a request, we will explain why, and you may ask us to reconsider.
Changes
When this page changes, the review date at the top changes with it. Material changes affecting clients are also sent to the contact named in each active engagement letter.