Privacy Policy

We collect information you provide directly, information generated by your use of the platform, and limited technical data:

• Account & organization data: name, work email, organization, role, and authentication credentials (stored as hashes, never in plaintext).
• Customer content: the compliance data, evidence, documents, integration credentials, and questionnaire responses you upload or connect.
• Usage & device data: log entries, IP address, browser/user agent, and actions taken in the product (audit logging).
• Public scanner inputs: a target URL and the requesting IP, used to run and rate-limit a scan. See the Scanner Policy.

To provide, secure, and improve the service: operating your workspace, running scans you request, authenticating users, maintaining audit logs, providing support, billing, and meeting legal obligations.

We do not sell personal data. We share data only with sub-processors that help us run the service (e.g. hosting, email delivery) and where required by law.

We retain customer content for the life of your account, then delete or anonymize it. Backups and audit logs are retained on a rolling schedule for operational and security purposes.

We apply tenant isolation, encryption of sensitive credentials at rest, and audit logging. See our security overview for current details.

Depending on your jurisdiction, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To make a request, contact us.

Data is hosted in the United States. Where we process personal data originating outside the United States, we rely on appropriate safeguards consistent with applicable law.

We will post material changes here and update the date above. Questions about this policy: contact us.