During the engagement
Your rules, field names, asset data, gaps, and verdicts are held to perform the agreed assessment. At close, assessment data and findings are returned to you and deleted from Dectyl, along with any access credentials.
Kept: structural patterns
How a SIEM version or add-on expresses a dependency: where macros resolve, how fields alias, how a parser update renames a field. These describe the SIEM, not your estate.
Benchmark: opt-in only
Unattributed counts contribute to an industry benchmark only with your written permission.
Ongoing engagements
Prior assessments can be retained to show what changed. The data retained and retention period are set in the program agreement; retained data is deleted at the agreed end.
Questions go to gyan@dectyl.io. We answer in writing.