Legal

Privacy Statement

Last updated: July 22, 2026

This statement explains what information the Cairnpoint service collects, how we use and protect it, who we share it with, and the choices you have. The canonical version is published at thirdwestlabs.com/privacy.

1. Who we are

Cairnpoint is a white-label risk-assessment platform operated by Third West Labs LLC, a Mississippi-registered limited liability company and an independent software studio. In this statement, “we,” “us,” and “our” refer to Third West Labs LLC. For any privacy question, contact us at privacy@thirdwestlabs.com.

2. Our role: controller and processor

For the account and billing information of our MSP customers, Third West Labs is the data controller.

For assessment data an MSP creates about its own prospects and clients — external scan results, Microsoft 365 posture data, and questionnaire responses — the MSP is the controller and Third West Labs acts as a processor, handling that data only on the MSP's instruction. If you are a prospect who received a questionnaire link, the MSP that invited you is responsible for that data; direct access and deletion requests to them, and we will support their instruction.

3. Information we collect

MSP customers (account holders)

• Identity & sign-in. You sign in with your organization's Microsoft Entra work account. We receive your name, email address, and Microsoft tenant identifier. We never see or store a password — authentication is federated to Microsoft, and your organization's MFA and Conditional Access policies apply as they are.
• Billing. Company name, billing email, and subscription status. Payments are processed by Stripe on Stripe-hosted pages; your card details never touch Cairnpoint.
• Usage & audit records. Operational logs of actions taken in the platform, kept for security, troubleshooting, and audit.

Assessment data (processed for the MSP)

• External attack-surface scans — passive analysis of a target's publicly reachable internet footprint.
• Microsoft 365 posture reviews — a read-only review of a tenant's security configuration via the Microsoft Graph.
• Questionnaire responses — answers a prospect provides through a guided discovery link, transmitted over an encrypted connection and used only to prepare the risk assessment.

Cairnpoint is not designed to receive protected health information (PHI), payment card data, or other regulated sensitive personal data. Please do not submit such data into scans or questionnaires.

4. How we use information

• Provide, operate, secure, and improve Cairnpoint.
• Authenticate users and enforce access controls.
• Run assessments and generate reports at the MSP's direction.
• Process subscriptions, invoices, and payments.
• Respond to support requests and communicate service notices.
• Detect, investigate, and prevent abuse or security incidents.
• Meet legal, tax, and accounting obligations.

We do not sell personal information, and we do not use assessment data to train models or for advertising.

5. Tenant isolation

Every MSP is its own tenant, signed in through its own Microsoft Entra tenant. Prospects, assessments, and reports are scoped to that MSP and are not pooled with other customers. Third West Labs holds no standing access to a tenant's data; support access exists only when an MSP mints a short-lived, audited access code from its own console, and it expires automatically.

6. Service providers and sharing

We share information only with the vendors that run the service, each bound to protect it and use it only to provide their service to us:

• Microsoft Azure — cloud hosting and storage.
• Microsoft — federated sign-in (Entra) and, for posture reviews, read-only Graph access.
• Stripe — payment processing and billing.
• Cloudflare — content delivery and edge security.

We may also disclose information when required by law, to enforce our agreements, or to protect the rights, safety, and security of our users and the service. If our business is transferred, information may move with it under this statement.

7. Data security

• Encryption in transit (TLS) and at rest.
• Least-privilege access and role-based access controls.
• Read-only Microsoft 365 scanning — we do not change your configuration.
• Audit logging of sensitive actions and time-boxed, audited support access.
• No local passwords — sign-in is federated to Microsoft Entra.

No system is perfectly secure, but we work to protect your data with industry-standard safeguards.

8. Data retention and deletion

We keep account and assessment data for as long as an MSP's workspace is active. When a subscription is canceled, the MSP chooses to keep its data (the default) or request deletion. A suspended workspace is eligible for permanent purge after a retention window (90 days by default), and purge is an irreversible, confirmed action. Billing and tax records are retained as long as the law requires. Aggregate, non-identifying analytics may be kept indefinitely.

9. Your choices and rights

• MSP administrators manage their own users (invite, change role, disable, remove) and can request data deletion from their console or by contacting us.
• Prospects who completed a questionnaire should direct access or deletion requests to the MSP that invited them; we will act on that MSP's instruction as its processor.
• Depending on where you live, you may have rights to access, correct, delete, or restrict the use of your personal information, or to object to certain processing. To exercise them, contact privacy@thirdwestlabs.com.

10. Cookies

Cairnpoint uses only the strictly necessary cookies required to keep you signed in and to operate the service securely. We do not use advertising or cross-site tracking cookies.

11. Children

Cairnpoint is a business tool intended for organizations, not for children, and is not directed to anyone under 16. We do not knowingly collect personal information from children.

12. International users and governing law

We operate from the United States, and information we process is stored and handled there. If you access the service from outside the United States, you understand that your information will be processed in the United States. This statement is governed by the laws of the State of Mississippi, USA, without regard to its conflict-of-laws rules.

13. Changes to this statement

We may update this statement as the service evolves. When we do, we will revise the “Last updated” date above, and we will provide a more prominent notice for material changes.

14. Contact us

Questions, requests, or concerns about privacy? Email privacy@thirdwestlabs.com and we'll respond promptly.