Data Privacy & Sovereignty Policy
Effective Date: January 1, 2026 | Document Reference: ABY-SEC-POL-001
Abyssinia Security Solutions is dedicated to national cyber defense education and high-assurance engineering. We do not sell, rent, monetize, or broker personal student telemetry, corporate audit data, or client identity records to any third party.
1. Information We Collect
To provide academic instruction, practical lab orchestration, and enterprise assessments, we collect strictly necessary data:
- Account Credentials: Full name, institutional email address, hashed passwords, and cryptographic session tokens.
- Academic & Range Telemetry: Course enrollments, lab container session logs, assignment commits, exam grade records, and attendance check-in timestamps.
- Enterprise Audit Telemetry: Authorized scope parameters, IP ranges, and signed non-disclosure metadata provided during consultation requests.
2. Technical Lab Logging & Isolation
All student cyber range exercises occur within isolated network environments. Network activity within virtual ranges is logged solely to prevent platform abuse, evaluate capture-the-flag flag submissions, and assess student technical mastery. Range container logs are permanently deleted 30 days after course completion.
3. Public Certificate Registry
When a student completes an academic curriculum and passes the capstone examination, a credential token containing the student’s name, course code, issue timestamp, and SHA-256 cryptographic signature is published to our public registry (`/verify`) to permit third-party employer verification. Students may request pseudonymization of their public credential records via academic support.
4. Data Retention & Security Measures
All sensitive records are encrypted at rest using AES-256 and transmitted exclusively over TLS 1.3. Access to administrative systems is restricted via multi-factor authentication, Zero Trust network proxies, and role-based access control.
5. Institutional Contact
Questions regarding data protection or requests to exercise data rights can be directed to our Chief Information Security Officer: