Fortinetics LLC ("Fortinetics," "we," "us") respects your privacy. This policy describes what information we collect, store, and process when you (a) visit fortinetics.com, (b) contact us, or (c) use a Fortinetics compliance reference tool — in the browser today, or in a native app once one is published — and how we handle it.
We publish this policy as a single document covering both the website and Fortinetics-published apps because most readers will encounter both surfaces. App-specific behaviors are called out in the "Apps published by Fortinetics LLC" section below; everything else applies to both surfaces.
What we collect
Information you give us. When you email us, request a scoping call, or otherwise contact us, we collect the information you provide, typically name, email address, company, and the content of your message. We use this information to respond to your inquiry.
Analytics. This site uses Cloudflare Web Analytics, which is privacy-first and does not use cookies or fingerprint visitors. It records anonymized, aggregate page-view statistics: roughly which pages were visited, from which country, on what browser. It does not identify individuals.
Server logs. Every request to this site reaches a Cloudflare Worker, which
records the request the way any web server does: your IP address, your browser's
User-Agent string, the URL requested, the time, and Cloudflare's own
CF-Ray request identifier. When you submit a form, those same three values are
included in the notification email we receive, so we can tell a genuine enquiry from an
automated one. We do not use them to build a profile of you, and we do not combine them
with the advertising identifiers described below.
Cookies and advertising. Stated plainly, because the shape of this is easy
to understate: every page on this site loads Google's advertising tag, not
only the commercial ones. That tag writes a first-party cookie,
_gcl_au, which lasts 90 days — so it is written on every page
you visit here, including the insights library, the framework pages, the comparisons and
the case studies. If you arrive from a Google ad, the click identifier in
the URL (gclid, gbraid or wbraid) is also exchanged
for a first-party _gcl_aw cookie, again for 90 days.
What differs between pages is what gets reported, not what gets written. On
commercial pages — the home page, service pages, contact page, readiness quizzes and ad
landing pages — the tag also reports conversion events, and the Reddit advertising pixel
loads alongside it and sets _rdt_uuid (90 days). On every other page there is
no Reddit pixel and no event is reported; the Google tag is there only so that a click
which lands on an article can still be matched to an enquiry made later from the contact
page. We would rather describe that accurately than claim the content library is
tracker-free when it is not.
Global Privacy Control and Do Not Track
If your browser sends either signal, none of the above happens. No advertising tag is requested, no cookie is written, no click identifier is captured, and no conversion is reported. Nothing is loaded and then suppressed — the check runs before any request leaves your browser, so the third-party hosts never see you at all.
The signals we read are navigator.globalPrivacyControl and the three
Do-Not-Track properties browsers have used over the years. They are resolved once per page
and read by all three of the things that could otherwise track you: the advertising tags,
the sitewide click-identifier tag, and the attribution capture that would record which
campaign brought you here. There is a note in that source file explaining why the check is
defined once rather than copied three times.
We mention this at some length because it is unusual, it is verifiable from the page source rather than only from this document, and we would rather be judged on it than on a statement of intent. Honouring GPC costs us measurement on a site that is about to spend money on advertising, which is exactly why it is worth stating that we do it anyway. Strictly necessary functional cookies may still be used where required to operate the site.
How we use information
We use the information you provide solely to respond to your inquiry, deliver contracted services, fulfill legal and contractual obligations, and maintain operational records.
Where form and quiz submissions go. They are stored as a row in a
Fortinetics-operated Cloudflare D1 database — our own database, on our own Cloudflare
account, not a third-party CRM product. The row holds what you typed (name, email,
company, phone, the framework and timeline you selected, and your message or quiz result)
together with the attribution we captured: the campaign parameters
(utm_source, utm_medium, utm_campaign,
utm_term), the page you first landed on, the referring site, and the Google
click identifier if you arrived from an ad. That last one is the field that lets us report
back to Google Ads, months later, that a click became real work — which is the only way a
federal-length sales cycle can be measured at all.
If your browser sent Global Privacy Control or Do Not Track, no attribution was captured and those fields are empty. The submission itself is still stored, because you asked us to contact you.
We do not sell your information. We do not share your information with third parties for their marketing purposes. We do not use your information to train machine-learning models.
Who processes information for us
We use a small number of service providers to operate the firm. Relevant to this site:
- Cloudflare — hosts this website, terminates TLS, and provides analytics. Cloudflare's privacy policy applies to their processing.
- Microsoft 365 (via GoDaddy) — operates @fortinetics.com email. Microsoft's privacy policy applies to their processing.
- GitHub — hosts our private source code repositories. GitHub's privacy policy applies to their processing.
- Resend — delivers form submissions to us by email. Resend processes the full contents of an enquiry, including anything you write in the message field. Do not send sensitive or classified detail through this form; that discussion happens under NDA.
- Google (Google Ads) — advertising measurement. The tag loads on every page of this site; conversion events are reported only from commercial pages. See "Cookies and advertising" above.
- Reddit — advertising measurement, commercial pages only.
- Calendly — scheduling, when you book a call. Calendly receives the name, email and any answers you give on its own booking form.
- Stripe — card payments and invoicing for clients under contract. Stripe receives the client's billing contact and invoice details and processes the payment; Fortinetics never receives or stores your card number. Stripe's privacy policy applies to their processing. This applies to clients, not to site visitors.
Apps published by Fortinetics LLC
Fortinetics LLC is preparing a small portfolio of compliance reference apps for the Apple App Store: utilities for CMMC, NIST 800-171, FedRAMP, DoD Cloud Computing SRG, SCIF/SAPF accreditation, and related federal-aligned compliance frameworks. None are published yet — the current versions run in the browser at /tools/, and this section states the posture that will apply when they ship. The categorical scope is intentional: only compliance and federal-cybersecurity reference apps will appear under "Fortinetics LLC" as the developer. Any other app you find published under "Fortinetics LLC" is not ours.
Per-app disclosures will govern. Once an app is published, its specific data practices are disclosed in that app's App Store listing under "App Privacy" (sometimes called "privacy nutrition labels"). Where this policy and an individual app's App Store disclosure differ, the App Store disclosure governs that specific app. The defaults below describe Fortinetics's standard data-handling posture for compliance reference apps; individual apps may collect less than the defaults but will not collect more without explicit disclosure.
Standard data posture. Compliance reference apps from Fortinetics are built to operate on-device wherever possible. As a default:
- No account required. Most apps work without sign-in. When sign-in is offered, it's optional and only enables features that need it (e.g., cross-device sync of saved checklists).
- Local storage by default. User-entered content (notes, scores, configurations) is stored on-device in app-private storage, not transmitted to Fortinetics servers, unless an explicit cloud-sync feature is offered and enabled by the user.
- No advertising or third-party trackers. Apps do not contain advertising SDKs, analytics SDKs that build cross-app profiles, or third-party trackers. Some apps may use Apple's first-party crash-reporting and on-device analytics (which are governed by Apple's privacy controls; you can opt in or out in iOS Settings).
- No tracking across apps or websites. Apps do not implement Apple's App Tracking Transparency tracker requests because we do not engage in tracking as Apple defines it.
- No selling or sharing for marketing. Information collected through apps is never sold, shared with data brokers, or used for third-party marketing purposes.
- No machine-learning training on customer data. Information collected through apps is never used to train, fine-tune, or evaluate machine-learning models — Fortinetics's own or third-party.
- No targeting users under 13. Fortinetics's compliance reference apps are designed for working professionals and are not directed at children. We do not knowingly collect information from users under 13.
What apps may collect. Specific apps may collect:
- Crash diagnostics — anonymized crash logs to improve app stability. Apple's standard mechanism; user-controlled in iOS Settings → Privacy & Security → Analytics & Improvements.
- Support inquiries — when you email an app's support address, we receive your message content, your email address, and any attachments you send.
- Optional cloud sync — for apps offering cross-device sync, the app may upload user content to iCloud (Apple-managed; covered by Apple's privacy policy) or to Fortinetics-operated infrastructure (disclosed per-app, encrypted in transit and at rest, deleted on user request).
- In-app purchase records — for paid apps or apps with paid features, Apple processes the purchase. Fortinetics receives only the anonymized purchase confirmation Apple provides; we do not receive your payment card information.
Push notifications. Apps may request permission to send push notifications. Notifications are limited to: (a) compliance-deadline reminders the user has explicitly configured, (b) app-update notices, and (c) responses to user-initiated actions. We do not use push notifications for marketing or promotional content.
App-specific privacy questions or data requests. See /support/ for app support contacts. Privacy and data-subject-access requests for any Fortinetics-published app should go to contact@fortinetics.com.
How we protect information
We apply the same controls to our own firm that we help clients implement for theirs: multi-factor authentication on all accounts, endpoint protection on all devices, full-disk encryption, centralized logging, and least-privilege access.
No transmission of information over the internet or storage in electronic form can be guaranteed one-hundred-percent secure. If you are sharing sensitive or classified information, we will execute a Mutual Non-Disclosure Agreement first.
Retention
We retain inquiry and contract correspondence for the life of the engagement and for twelve (12) months after the final invoice. Longer retention may apply where legally required.
Your rights
You may request a copy of the information we hold about you, ask us to correct inaccuracies, or request deletion, subject to any legal or contractual record-retention obligations. Send requests to contact@fortinetics.com.
Changes
We may update this policy. The "Last updated" date at the top reflects the most recent revision. Material changes will be announced on this page.
Contact
Questions about this policy: contact@fortinetics.com.