Skip to main content
Let's Talk!

Service Privacy Guide

Last Revision March, 13, 2025
Initial Version December 5th, 2024

 

What services does InceptionCyber.ai provide?

Inception Cyber delivers a Cloud Email Security Service (Service), running on AWS, designed to protect enterprises from evasive and AI-powered email threats that bypass traditional defenses. At its core is Intent-Based AI Threat Detection, which understands the purpose and meaning of an email rather than relying on payload analysis (URLs, attachments) or behavior models.

Legacy email security solutions—including signature-based detection, sandboxing, machine learning (ML), and behavioral analysis—struggle against today’s threats. Attackers evade these defenses by obfuscating payloads, leveraging social engineering, and now using AI to power attacks with more scale, precision, and variance.

Inception Cyber’s Neural Analysis and Correlation Engine (NACE™) takes a radically different approach. Instead of chasing URLs or attachments, it applies generative and predictive AI, semantic and thematic analysis, and zero-shot classification to detect threats. This allows NACE to proactively stop ransomware, phishing, BEC, and AI-generated threats before they reach the inbox—even when traditional detection methods fail.

As attackers continue to scale campaigns with AI, Inception Cyber ensures enterprises stay ahead with real-time detection, proactive threat prevention, and seamless cloud-native integration for Microsoft 365 and Google Workspace environments.

The Service covers a wide range of attacks, including:

  • Ransomware and Evasive Attachments
    • Detects threats such as password stealers, HTML smuggling, downloaders, droppers, and other malware.
  • Phishing and Evasive Call-to-Action URLs
    • Identifies QR codes, brand impersonation, and callback scams.
  • Business Email Compromise (BEC)
    • Protects against scams like initial lures, gift card fraud, W-2 fraud, aging report fraud, wire transfers, invoice scams, acquisition scams, payroll scams, and VIP/CEO impersonation.
  • Account Compromise
    • Detects internal and external email account compromise as well as vendor account compromise.
  • AI-Generated Variations
    • Identifies BEC, phishing, ransomware, and malware generated by AI, tackling the increasing adaptability and variation of these threats.
  • Generic Scams and Other Conversational Payloads
    • Protects against evolving scam techniques leveraging conversational dynamics to manipulate recipients.

Personal Data Processing

Unlike traditional Secure Email Gateways (SEGs), the Service integrates directly with cloud-based email platforms like Microsoft Office 365 and Google Workspace through native APIs. This cloud-native architecture enables seamless access to the email environment, allowing for advanced threat detection without disrupting email flow or requiring significant infrastructure changes.

The Service processes data within the customer’s email system to deliver its advanced security capabilities, addressing threats like ransomware, phishing, Business Email Compromise (BEC), account compromise, and AI-generated attack variants. Since email inherently contains personal data, the Service processes this data in compliance with global privacy frameworks to ensure its security, integrity, and confidentiality.

Designed with privacy-by-design principles, the Service adheres to key privacy standards such as data minimization and purpose limitation. Only the data necessary to enable the Service’s threat detection capabilities is processed, and personal data is used solely to provide and improve the Service.

Key Privacy Practices Include:

  • Processing only the minimum necessary personal data to deliver the Service’s capabilities.
  • Leveraging attacker signals and malicious data for collective intelligence while ensuring personal data is anonymized or de-identified.
  • Aligning with global privacy regulations and maintaining rigorous data protection throughout its lifecycle.
  • This cloud-native, API-based approach ensures that Inception Cyber provides cutting-edge email security while respecting customer privacy and maintaining high compliance standards.

What Data Types Does the Service Process and Why?

The Service processes several categories of data, aligning with privacy principles of data minimization, purpose limitation, and transparency. The following outlines the types of data processed, their purpose, and the storage limitations implemented to ensure customer privacy and security.

Email Metadata

 

Description:
  • Data assigned by email clients, servers, and message transfer agents during email transit, such as: Email headers (recipients, subject, SMTP data, IPs, mail path, authentication results).
Processing and Purpose:
  • The Service uses email metadata for analyses such as SPF, DMARC, and DKIM validation.
  • Metadata helps identify suspicious patterns, such as unusual IP addresses or authentication failures, to detect potential account compromise or spoofing attempts.
Storage and Limitation:
  • Malicious email metadata is stored for 180 days by default to track long-term suspicious patterns.
  • Non-malicious metadata is processed in real-time and not retained.

 

Blind Carbon Copy (BCC) Address Information

 

Description:
  • Information not present in standard email headers but useful for identifying additional recipients of message
Processing and Purpose:
  • The Service analyzes BCC data to detect techniques attackers use, such as leveraging blind recipients for widespread phishing or BEC attacks.
Storage and Limitation:
  • Stored as part of email metadata for up to 180 days by default, only for malicious email data.

 

Email Body Content

 

Description:
  • Content within email bodies and their attachments (e.g., PDFs, images, or executables).
Processing and Purpose:
  • The Service scans body content and attachments to identify threats such as malware, ransomware, phishing links, and other malicious payloads.
  • Hyperlinks in email content are analyzed for call-to-action scams or malicious domains.
Storage and Limitation:
  • Non-malicious email body content and attachments are processed in real-time and not retained.
  • Malicious content is stored for 180 days by default to support threat analysis and detection improvements.

 

Email System Metadata

 

Description:
  • Identifiers provided by the customer’s email system (e.g., Microsoft or Google) to facilitate API integration, such as: Tokenized user IDs or message IDs.
Processing and Purpose:
  • Enables the Service to interact with the email provider’s APIs for message retrieval, analysis, and remediation
Storage and Limitation:
  • Stored securely for 180 days by default to ensure seamless operation of the Service.

 

Inception Metadata

 

Description:
  • Data derived or generated by the Service during analysis, including:
    •  Semantics, thematic meta data, number of links or attachments, deep file results of attachments, domain information for contained links, auxiliary information from SMTP headers i.e. these are the features which anonymizes data and removes PII information. 
Processing and Purpose:
  • Generated metadata helps the AI model to learn semantic and thematic associated with malicious and benign attachments/ URLs.
  • Used for topic and thematic analysis to infer malicious attachments, Phishing and  BEC scams
Storage and Limitation:
  • Retained for up to 180 days by default to improve AI detection models and strengthen federated threat intelligence.
 

How Long Does the Service Retain Data?

The Service retains data according to the default retention times listed in the table above. In rare instances where additional analysis is required, such as validating malicious indicators identified by the Service, personal information may be temporarily stored until the review is completed. This process is designed to conclude within three hours of receiving the relevant data.

Can the Service Delete and/or Rectify Data?

Yes. Customers can request data deletion or rectification by contacting Inception Cyber’s support team. Upon receiving a request, our team promptly reviews it and collaborates with the customer to address their needs without undue delay. Requests can include personal data or any other data types processed by the Service.

Does the Service Encrypt Data It Processes?

Yes. The Service employs robust encryption protocols to ensure data security, both in transit and at rest:

  • Data in Transit: All data transmissions use secure protocols, including TLS 1.2 with a 2048-bit RSA asymmetric key. HTTPS is mandatory for all traffic to ensure secure communication.
  • Data at Rest: Data is encrypted using AES-256, an industry-standard encryption method, across all storage systems. This includes production databases, processing files, backups, and snapshots.

Multi-layer encryption technologies and strong access controls further enhance data security.

Does the Service Process Data Securely?

Inception Cyber ensures secure data processing through its robust Information Security Program (ISP), which includes technical and organizational measures aligned with industry standards. Security practices are informed by cross-functional collaboration between the Security, Engineering, Infrastructure, and Product Management teams.

To validate the effectiveness of our security controls, Inception is currently undergoing readiness for HIPPA and SOC 2 Type 1 and SOC 2 Type 2.  

Key Features of the Information Security Program

Email Account Compromise Detection

    • Role-based access control is implemented, granting access on a need-to-know basis aligned with job functions and the principle of least privilege.
    • Multi-factor authentication (MFA), including biometric verification, is required for system access.
    • Access is regularly reviewed and revoked upon role changes or termination.
    • Physical security includes 24/7 CCTV monitoring, and no customer data is stored on premises.

Network and Cloud Security

    • The Service uses Amazon Web Services (AWS) Virtual Private Cloud (VPC) for system isolation and protection.
    • VPCs and AWS Security Groups provide firewall protection and subnet separation to securely manage connectivity between systems.

Credential and Key Management

    • Encryption keys (e.g., OAuth secrets for O365 and cipher keys) are securely stored in AWS Key Management Service (KMS), which uses FIPS 140-2 validated hardware security modules.

Security Practices & Policies

    • Production code is peer-reviewed and deployed via controlled processes as part of a secure Software Development Lifecycle (SDLC).
    • Role-based access is assigned only on a per-need basis and regularly reviewed.
    • Systems and applications are monitored 24/7 for unauthorized access or signs of compromise using a defense-in-depth approach.
    • Vulnerabilities and patches are prioritized and addressed promptly in accordance with internal policies.

Through these measures, Inception Cyber ensures a secure environment for customer data and delivers an industry-leading standard for email threat protection.