Atalaya
Privacy & data handling
Atalaya is privacy-first by design: every flow of data outside your organization is an EXPLICIT operator decision, never a default. This page summarizes exactly what is processed, where and when.
What is processed and where
| Data / operation | Where it is processed | Does it leave your org? |
|---|---|---|
| Email parsing, heuristic rules, scoring, QR decoding, reports | Local (Atalaya server) | No |
| IOCs: URLs, domains, public IPs, SHA256 hashes | External threat intelligence feeds | Only if you enable “Enrich” |
| Email headers + body (truncated) + your org context | AI model (LLM) | Only if you enable “AI” |
| Following a link (HTTP request to the destination) | The link's destination server | Yes — the destination is contacted, with an SSRF guard |
| Organization profile (domains, key people, vendors, rules) | Backend store | Not shared; used only for your analyses |
| Email body via enrichment | — | NEVER through this path |
Retention
- Analysis history: 30 days per user (you can review it; it expires automatically).
- Result cache: 10 minutes (speeds up identical re-analysis and saves quota).
- Usage counters: per day, reset at 00:00 UTC.
- Organization profile: persists until you delete it from your account.
- Uploaded files: processed in memory and not stored after analysis.
What we NEVER do
- Sell or share your data with third parties for advertising.
- Train AI models on your content.
- Send your email bodies to any service unless you enable “AI” for that analysis.
- Apply external enrichment or AI by default: both are opt-in per analysis.
Subprocessors (by category)
Atalaya relies on external providers for hosting, storage and enrichment. The full named list is available on request and in the Data Processing Agreement (DPA).
| Hosting / compute | Cloud provider (EU region) running the application. |
| Key-value store | Quota, cache and history (no email content). |
| Threat intelligence feeds | URL/domain/IP/hash reputation — they only receive IOCs. |
| AI model provider (LLM) | Assisted verdict — only when you enable “AI”. |
On-premise / air-gapped mode
For regulated environments (ENS, public sector, banking) Atalaya can be deployed on-premise. Local analysis (parsing, rules, scoring, QR) works WITHOUT any external service: enrichment and AI are simply disabled. Available via Docker container.
Contact
For the DPA, the named subprocessor list or any privacy query: contact@alexfernandezlab.com