MKCS AI Trust Intelligence — Privacy Policy
Information processed
MarkoTek may process business contact information, Microsoft Entra tenant and identity identifiers, application and service-principal metadata, AI agent and MCP metadata, governance settings, findings, evidence snapshots, audit records, billing contact information, usage information, support information, and payment-processor identifiers needed to operate MKCS AI Trust Intelligence.
Payment information
MKCS does not intentionally store full payment-card numbers, CVV values, full bank-account numbers, or bank credentials. Payment credentials are collected and tokenized by the configured payment processor. MKCS stores processor identifiers and masked metadata needed for billing operations.
Purposes
Information is used to authenticate users, maintain tenant isolation, enforce application-role authorization, discover customer-authorized directory metadata, provide AI governance workflows, generate evidence and audit records, provide support, process billing, prevent abuse, diagnose service issues, and satisfy contractual or legal obligations.
Service providers and connected systems
MarkoTek may use approved service providers for cloud hosting, identity, payment processing, communications, security, monitoring, and support. Customer administrators control customer-user access and connected-system permissions. The Enterprise Connector reads only data authorized through customer-admin consent and the permissions configured for the connector.
Retention and customer requests
Retention is based on service operation, subscription and contractual requirements, security and audit needs, and applicable law. Customers may request applicable access, correction, export, or deletion through their MarkoTek account contact, subject to security, audit, contractual, and legal retention requirements.
Regulated information
When a customer elects to govern PHI/ePHI, personal data, or other regulated information, customer-specific contractual terms may be required. Enabling an aligned policy pack does not itself establish HIPAA, GDPR, FedRAMP, or other regulatory compliance.