Privacy policy

The data controller is [Company name], [Address], [contact email].

Account data: name, email address, hashed password or OAuth identifier (Google, GitHub), language preference, plan.

Project data: the URLs and domains you register, verification tokens, and the results of checks (scores, findings, response headers, excerpts of public pages, table and column names of exposed databases, load-test metrics).

Billing data: handled by Stripe. We only store your Stripe customer and subscription identifiers, never card numbers.

Technical data: IP address and user agent for security and rate limiting, server logs kept for 30 days.

Passive checks only read public pages and headers. Active checks run only after you verify domain ownership. When an exposed database table is detected, we read a single row (limit=1) to confirm the exposure and keep only the table name and column names. Row contents are never stored or displayed.

To provide the Service (contract), to send transactional emails about your checks and account (contract), to prevent abuse (legitimate interest), to comply with legal obligations such as invoicing, and, with your consent, to send product updates.

Hosting and serverless functions: Vercel. Database: a managed PostgreSQL provider. Emails: Resend. Payments: Stripe. Optional load-test providers when configured: Grafana Cloud k6, loader.io (they receive the target URL and test parameters). Optional analytics: Plausible (cookieless). These providers may process data outside the EU under standard contractual clauses.

Account and project data are kept while your account is active and deleted within 30 days of account deletion. Invoices are kept for the legally required duration. Logs are kept for 30 days.

You can access, correct, export and delete your data from the settings page or by contacting [contact email]. You can object to processing based on legitimate interest and lodge a complaint with your supervisory authority (in France, the CNIL).

We only use strictly necessary cookies (session, theme, language). If analytics are enabled, we use Plausible, which does not use cookies and does not track individuals.