Pelypso Terms of Use

Welcome aboard

Pelypso helps your organization spot risks early and steer them to safety. Before you start, please read these terms. They take about three minutes.

1. Who these terms apply to

Pelypso is provided by White Nautilus LLC (“we”) to your organization, under your organization's agreement with us. Your organization invited you, decides your role, and controls its data. These terms cover how you, as an individual, use Pelypso. If they ever conflict with your organization's agreement, your organization's agreement wins.

2. Your account

Sign in with your organization's account. You sign in through your organization (for example, Microsoft or Okta). Keep that sign-in to yourself, and use multi-factor sign-in if your organization asks you to.
One person, one account. Don't share your account or let someone else use Pelypso as you.
Your role decides what you see. Field Team, Mission Lead, Command and Administrator roles see different things. If you can see something you think you shouldn't, tell your Administrator.

3. Using Pelypso well

Please:

Report in good faith. Describe risks honestly and as accurately as you can. Not sure if something is a risk? Report it anyway.
Keep secrets out. Never put passwords, API keys, access tokens, card or bank numbers, or Social Security numbers in a report, comment or file. If you spot someone sharing a password, report that it happened, not the password itself.
Only include personal details when they're needed. Avoid health, financial or other sensitive information about people unless the risk can't be described without it.
Be respectful. No harassment, threats or discriminatory content.

Please don't:

try to get around permissions, see data your role doesn't allow, or sign in as someone else;
test, scan or attack Pelypso's security without written permission from White Nautilus;
copy, scrape or resell Pelypso or its content, or reverse-engineer the software;
upload malware, or anything you don't have the right to share.

Vendors and contractors: you see only the operations your host organization gives you. Keep what you see confidential, as your contract with that organization requires.

4. Reporting a security problem

If you find a security problem in Pelypso itself, please tell us at info@pelypso.com and don't share it publicly until we've had a chance to fix it. Good-faith reports are welcome and appreciated. For risks in your organization's own systems, file a field report in Pelypso as usual.

5. What you add to Pelypso

It belongs to your organization. Reports, comments, files and decisions you add are your organization's records. They may be subject to public records laws, so write as if they could be read later.
Others in your organization can see it, according to their roles. Mission Leads read field reports, Command sees escalations, and Administrators manage access.
Changes are recorded. Pelypso keeps an audit log of changes to people, permissions, structure and settings, and a history of each risk. Those records can't be edited or deleted.

6. The leaderboard, badges and photos

Pelypso may show a leaderboard and badges for spotting risks and reporting on time, if your organization turns them on. Your organization can show first names only or turn the leaderboard off. A profile photo is optional. If you add one, keep it appropriate for work. Your Administrator may remove a photo.

7. Emails from Gertrude

Pelypso sends email from gertrude@pelypso.com: invitations, reminders about reports or orders that are due, and, for Mission Leads and Command, a regular digest. You can change how often the digest arrives, or turn it off, under Email digest. Invitations and reminders about your own overdue work can't be turned off while you have an active account.

8. Privacy notice

What we collect: your name, work email, job title and organization; your role and the operations you work on; what you add to Pelypso; a profile photo if you add one; and technical records needed to keep Pelypso secure, such as sign-in times and IP addresses.

Why: to run Pelypso for your organization, show you the right information, send the emails described above, keep the service secure, and fix problems.

What we don't do: we don't sell your information, use it for advertising, or use it to train artificial intelligence models.

Who helps us: Cloudflare hosts Pelypso in the United States, and Microsoft 365 sends Gertrude's emails. Your organization's sign-in provider signs you in.

How long we keep it: as long as your organization uses Pelypso and its retention settings say, then we delete it as your organization's agreement describes.

Your choices: to see, correct or remove your information, ask your Administrator, who manages your organization's data. You can also contact us at info@pelypso.com.

If you request a briefing on pelypso.com: we collect what you enter in the form (your name, work email, organization, role, how many programs you run and your message), and a one-way scrambled code made from your IP address that can't be turned back into the address. We use it only to reply to you, schedule your briefing, prepare a quote if you ask for one, and keep the form from being flooded with spam. Your request is stored on Cloudflare in the United States and emailed to us through Microsoft 365. We don't sell it, add you to a mailing list, or use it to train artificial intelligence models. We keep it for up to two years after you send it, then delete it. To have it deleted sooner, email info@pelypso.com.

9. Suspension

Your organization can suspend your account at any time, for example when you change jobs. We may suspend an account that threatens Pelypso's security or breaks these terms, and we'll tell your organization when we do.

10. Changes to these terms

If we change these terms in a way that matters, we'll show you the new version the next time you sign in and ask you to accept it before you continue. Small fixes, such as typos, don't need a new acceptance.

11. Contact

Questions about these terms, or help using Pelypso: ask your Administrator, or email info@pelypso.com.