How we handle your information
Last updated October 14, 2026
This notice covers the CritResponse tabletop exercise platform at app.critresponse.com and this website.
Exercise participants
Participants join a session with a room code. We collect only:
- the display name you type (a first name is enough) and the role you choose;
- the actions you take during the exercise, with timestamps.
We don't ask participants for an email address, phone number or account. Your browser keeps a small token so you can reconnect to your seat if your connection drops; it stops working when the session ends.
Client organizations
To tailor an exercise, we record your organization's name and industry and which security capabilities you have in place (for example, endpoint protection, backups or cyber insurance), with any notes you provide. Exercise results, including the capability gaps your team identifies, become your after-action report.
CritResponse staff
Facilitator and administrator accounts store a name, email address and sign-in details (a salted password hash, or a link to a Microsoft 365 account). Sign-ins, failed sign-ins and report downloads are recorded in an audit log.
How it's protected
- Connections are encrypted with TLS.
- After-action reports are encrypted at rest.
- Information meant only for the facilitator (the scenario deck, private notes, other players' cards) is kept on the server and never sent to participants' browsers.
- Access to client information is limited to CritResponse staff.
How long we keep it
By default, reports are kept for three years, and the detailed event log behind a report is deleted one year after the report is finalized. Clients can ask for a different retention period.
This website
This site has no analytics, advertising trackers or cookies. Pages load fonts from Google Fonts, which receives your IP address when serving them.
If you use the contact form, we store what you enter (name, email, company, phone, message) with your IP address and browser type, and email it to CritResponse through Microsoft 365. We use it only to reply to you.
Questions or requests
To ask about, correct or delete information we hold, use the contact form.