Privacy Policy · Triton Cloud

Triton Cloud ("Triton," "we," "our," or "us") is a cloud infrastructure service operated by Sovren Technologies, Inc. d/b/a Triton Cloud. This Privacy Policy explains what information we collect when you visit tritoncloud.io, create a Triton account, or use the Triton console, API, CLI, or related services (together, the "Services"), how we use that information, and the choices and rights you have.

This policy is written for a business service. Most of the people using Triton are doing so on behalf of a company, and most of the information we hold is account and billing information about that relationship — not information about personal life. Your use of the Services is also governed by our Terms of Service and Cookie Policy.

1. The Distinction That Matters Most: Your Content vs. Your Account Data

Triton holds two very different kinds of information, and we treat them very differently.

Customer Content is what you run and store on the Services: the data on your Instances, the objects in your Buckets, your configuration, your application data, and anything your own users send through systems you host with us. Customer Content belongs to you. We do not sell it, mine it, analyze it for advertising, or use it to train machine-learning models. We do not access the contents of your Instances or Buckets except in the narrow circumstances described in Section 4.

Account Data is the information we need in order to provide, bill for, secure, and support the Services: who your account belongs to, what resources exist in it, how much they are used, who logged in and when, and how you have contacted us. This Privacy Policy is mostly about Account Data.

2. Information We Collect

Information you provide to us

Account and registration information. Your name, email address, and password when you create an account; your organization or Team name; the display name and role of each user you invite; and any phone number you provide for account recovery or security.
Billing information. Your billing name, billing address, tax identifiers where applicable, and the payment method on file. Card and bank details are collected and stored by our third-party payment processor on our behalf — Triton does not store full payment card numbers on its own systems.
Identity and anti-fraud information. At signup we may verify a payment method and collect signals used to detect fraudulent or abusive account creation.
Support communications. If you contact support, sales, or our abuse team, we receive your message, any attachments or logs you send us, and the contact details you use.
Credentials you create. SSH public keys, API tokens, and access keys you generate in the console. We store the public half of an SSH key pair; we never ask for or hold your private key.

Information we collect automatically

Service and usage data. Which resources exist in your account, their Region, size, lifecycle state, and metered consumption — compute hours, object storage volume, network transfer, and similar measurements needed to bill you accurately and to plan capacity.
Console and website activity. Pages viewed, features used, actions taken in the console, and the dates and times of those actions.
Log and device information. IP address, browser type and version, operating system, device identifiers, referring URL, and access times. Authentication events, API calls, and administrative actions are recorded in an audit log associated with your account.
Cookies and similar technologies. Described in our Cookie Policy.

Information from third parties

Payment processor. Confirmation of successful or failed charges, the last four digits and brand of a card, and fraud signals.
Identity providers. If your organization signs in through single sign-on, we receive the attributes your identity provider sends us — typically name, email address, and group membership.
Abuse and security feeds. Reports from other network operators, security researchers, and public blocklists concerning traffic originating from Triton addresses.

3. How We Use Information

We use the information described above to:

Create, secure, and administer your account, Teams, and Projects.
Provide, operate, maintain, and improve the Services.
Meter usage, calculate charges, process payments, and issue invoices.
Send you service and administrative messages — provisioning notices, billing alerts, security notifications, maintenance windows, and changes to our terms.
Respond to your support requests and diagnose problems you report.
Detect, investigate, and prevent fraud, abuse, network attacks, and violations of our Terms of Service or Acceptable Use Policy.
Monitor capacity, reliability, and performance, and plan future capacity.
Comply with legal obligations and respond to lawful requests, and to establish, exercise, or defend legal claims.
With your consent where required, send you product announcements and marketing communications about Triton. We do not use Customer Content for any of these purposes except as described in Section 4, and we do not use any information we hold to build advertising profiles or to train machine-learning models.

4. When We Access Customer Content

We access the contents of your Instances and Buckets only in these circumstances:

With your instruction or permission — for example, when you open a support ticket and expressly ask us to look at a specific resource in order to diagnose the problem.
Where automated systems must touch data to deliver the service — for example, storing, replicating, and returning objects you have placed in a Bucket. This is machine processing required to operate the service, not human review.
To investigate a credible report of abuse or a live security threat, or where we reasonably believe access is necessary to protect the integrity of the platform or the safety of others.
Where required by law, as described in Section 5. Staff access to production systems is limited to personnel who need it, is authenticated, and is logged.

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes. We disclose information only as follows.

Service providers and subprocessors

We use a limited set of vendors to run the business — payment processing, email delivery, error monitoring, customer support tooling, and infrastructure services. They may process information on our behalf, only under contract, only for the purposes we specify, and subject to confidentiality and security obligations.

A current list of the subprocessors we use is available on request from privacy@tritoncloud.io. Where we have entered into a data processing agreement with you, we will give advance notice of any new subprocessor as that agreement requires.

Within your organization

Information about your account — including usage, resources, invoices, and audit-log entries showing actions you took — is visible to other members of your Team according to their role. An account Owner can see billing information; Owners and Admins can see resource activity. If your employer administers the account, they control it.

Legal and safety disclosures

We may access, preserve, and disclose information if we believe in good faith that doing so is required or appropriate to comply with applicable law, a subpoena, court order, or other valid legal process; to enforce our Terms of Service; to respond to a claim of illegal activity or infringement; or to protect the rights, property, or safety of Triton, our customers, or the public. Where we are legally permitted to do so, we will make reasonable efforts to notify the affected customer before disclosing information in response to legal process.

Corporate transactions

If Triton or Sovren Technologies, Inc. is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction. The transferred information will remain subject to this Privacy Policy, or you will be notified of any materially different policy that applies.

We share information in other ways when you direct or permit us to.

6. Data Retention and Deletion

Customer Content is retained while the resource holding it exists. When you destroy an Instance or delete an object or Bucket, the underlying storage is released and the data becomes irrecoverable to you immediately.
Past due and suspended accounts. If a payment fails, your account enters a seven (7) day grace period during which your resources keep running. If the balance is still unpaid at the end of that period, we suspend the account and stop your resources, and Customer Content is retained for a further fourteen (14) days. We notify you before that retention period ends. Content not recovered within it is permanently deleted.
Closed accounts. If you close your account, the resources in it are destroyed and their Customer Content is deleted.
Account and billing records are retained for as long as the account is open and afterwards for the period required by tax, accounting, and legal-obligation rules.
Logs, audit records, and metering data are retained for a limited period for security, billing dispute resolution, and capacity planning, then deleted or aggregated into a form that no longer identifies an individual.
Backups are cycled on a fixed schedule; data deleted from live systems persists in backups until those backups age out.

7. Security

We use physical, technical, and administrative safeguards designed to protect the information we hold, including encryption in transit, access controls, authentication logging, and separation between customer environments.

Security on a cloud platform is shared. We are responsible for the security of the platform; you are responsible for the security of what you run on it — your operating system and application patching, your access credentials, your network rules, and who you grant access to your Team.

One point deserves specific mention because it is easy to get wrong: the platform firewall is not enforced on an Instance until firewall enforcement is enabled for that Instance. Rules that exist but are not enforced do not protect anything. Please confirm enforcement is on before treating a rule set as protection.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you as required by applicable law.

8. International Data Transfers

The Services are hosted in the United States. If you access the Services from outside the United States, you are transferring information to the United States for storage and processing, where privacy laws may differ from those in your jurisdiction. By using the Services you consent to that transfer.

9. Your Choices

Account information. You can review and correct your account and profile information in the console at any time.
Marketing communications. You can unsubscribe from marketing email using the link in any such message or through your account settings. You will continue to receive administrative and service messages — billing notices, security alerts, and maintenance notifications — because they are part of the Services.
Cookies. See our Cookie Policy for browser and consent controls.
Closing your account. You can close your account from the console. Closing an account destroys the resources in it.

10. Privacy Rights in U.S. States

Residents of a number of U.S. states have specific rights over their personal information. Depending on your state, these typically include the right to know what personal information we collect and why, to access a copy of it, to correct inaccuracies, to delete it, to opt out of sale or of targeted advertising and profiling, and to appeal a decision we make about such a request.

Triton does not sell personal information and does not use it for targeted advertising or profiling. If that ever changes, we will update this policy and provide an opt-out before the change takes effect.

State privacy laws currently granting such rights include those of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia. Personal information does not include publicly available government records, deidentified or aggregated information, or information excluded from the scope of those laws.

Exercising your rights

Email privacy@tritoncloud.io. Only you, or someone legally authorized to act on your behalf, may make a request about your personal information, and we must be able to verify your identity before acting. We will confirm receipt within ten (10) business days and aim to respond substantively within forty-five (45) days. If we need more time — up to a further forty-five (45) days — we will tell you why in writing.

We will not discriminate against you for exercising any of these rights.

Where Triton processes personal information on your behalf as part of Customer Content, we act as a service provider or processor. If you are an end user of a service someone else runs on Triton, please direct your request to that organization; we will assist them in responding.

11. Rights in the European Economic Area and the United Kingdom

If your personal data is collected in connection with our activities in the EEA or the UK, you have the right to withdraw consent where consent is our lawful basis; to access your personal data; to have inaccurate data corrected; to have data erased where it is no longer necessary or was unlawfully processed; to have processing restricted in certain circumstances; to receive certain data in a machine-readable format; and to object to particular uses of your data.

The right to erasure is not absolute — we may need to retain data to meet a legal obligation or to establish or defend a legal claim. You may also lodge a complaint with the supervisory authority in your country or region.

Sovren Technologies, Inc. d/b/a Triton Cloud is the data controller for Account Data processed in connection with the Services. For Customer Content, the customer is the controller and Triton is the processor.

12. Children

The Services are intended for businesses and for individuals aged 18 or older. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact privacy@tritoncloud.io and we will delete it.

13. Changes to This Policy

We will post any changes on this page and update the effective date above. If we materially change how we use or share personal information we have already collected, we will notify you through the Services, by email, or by other means before the change takes effect. Your continued use of the Services after a change takes effect constitutes acceptance of it.

14. Contact Us

Questions, comments, or concerns about this policy or our processing activities:

Privacy requests: privacy@tritoncloud.io

General and legal: legal@tritoncloud.io

Support: support@tritoncloud.io

Sovren Technologies, Inc. d/b/a Triton Cloud

Attn: Privacy Request

2801 Network Boulevard, Suite 300

Frisco, TX 75034