Privacy notice
Effective
This notice explains how ("we") handles personal data when you use . We are the controller of the personal data described here. Contact us at .
What we never collect
Firewall configurations are analysed in your browser. We never receive, store or log configurations, or the findings, hostnames, IP addresses, rule names or reports that come from them. (If you choose to list assets for vulnerability monitoring, we store the details you type in, as described below.) PDF reports are generated in your browser and saved straight to your device.
What we collect
| Data | Why | Lawful basis |
|---|---|---|
| Name, email address, password (stored as a hash), two-factor settings | Create and secure your account | Contract |
| Company name, billing email, country, VAT number, report logo, team members and roles | Run company accounts, invitations and billing | Contract |
| Plan, subscription status and Paddle customer and subscription IDs | Give you the features you pay for | Contract |
| Usage metadata: time, user, action (review, change review, multi-firewall review, PDF, conversion), platform, rule count, score, grade, number of findings by severity, chosen standard | Apply plan limits, show your company's usage history, improve the Service | Contract; legitimate interests |
| Device records (paid plans): a label you choose and a salted one-way fingerprint of the device's hostname, made in your browser | Show each device's score history | Contract |
| Accepted risks (paid plans): a one-way fingerprint of the finding, its check type and severity, the reason and expiry date you enter, and who accepted it | Run your company's risk register | Contract |
| Review sign-offs (paid plans): who signed off, when, the score and finding counts, the review cycle and the note you enter | Audit evidence of periodic firewall reviews, and reminder emails | Contract |
| Client folders (MSP plan): client names and logos you add | Group devices and brand reports | Contract |
| Vulnerability scanner (paid add-on): the IPs and assets you add as scan targets and the ownership-verification tokens; scan profiles and schedules; installed scanner names and a one-way hash of each scanner licence; and, for completed scans, the live hosts found (IP, hostname, MAC, detected OS/vendor/type, open ports) and the vulnerabilities matched to them | Run the scans you ask for against targets you have verified you control, show you the results, and map them to CVE, CISA KEV and MITRE ATT&CK | Contract |
| Team job role (manager, technician, accounts, other) and whether a person receives invoice copies | Organise your team and send invoices to the right people | Contract; legitimate interests |
| Assets you list for vulnerability monitoring (paid plans): platform, model and software version, and optionally an asset name, external IP address and internal IP address; the vulnerabilities matched to them; alert settings and extra alert email addresses; a daily count of assets for billing | Check your devices against public vulnerability data, email you about new vulnerabilities, and charge for the service | Contract |
| Referrals: which company's link a new company signed up with, whether it subscribed, and reward status | Give the discount and reward | Contract; legitimate interests |
| Acceptance of our terms (version and time) | Record our agreement with you | Legal obligation; legitimate interests |
| Emails you send us, and messages through the Contact us page: name, email, company, topic, message and the page you came from | Reply to you and provide support; handle privacy requests and complaints | Legitimate interests; legal obligation (privacy requests) |
| Reports through the Report a problem page: name, email, the page and what you tell us | Investigate security issues, misuse, privacy concerns and wrong information, and tell you what we decided | Legitimate interests; legal obligation |
| “Report a problem with this page”: the page, what’s wrong, and an email address if you give one | Fix problems on the site | Legitimate interests |
| A one-way, salted fingerprint of the IP address that sent a form (never the address itself) | Stop spam and abuse by limiting how many messages one address can send | Legitimate interests |
| Records of complaints and personal data breaches, and a log of actions our admins take on accounts | Handle complaints, meet our breach-recording duty, and keep our own staff accountable | Legal obligation; legitimate interests |
| IP address, browser and timestamps in hosting and security logs | Keep the Service secure and working | Legitimate interests |
Paddle collects your payment details and billing address as merchant of record and is a separate controller for that data under its own privacy notice. We never see your full card number.
Free network tools
The free tools (MX lookup, DNS, SPF and DMARC checks and so on) run in your browser. Lookups go directly from your browser to public services: Cloudflare’s and Google’s public DNS-over-HTTPS resolvers, the regional internet registries’ RDAP services (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC) and crt.sh. Those services see your IP address and what you look up, under their own privacy policies. We don’t receive or store your lookups.
Who we share data with
We use these providers to run the Service. They process data on our instructions under written contracts (also listed on our sub-processors page):
| Provider | What they do for us | Data | Location |
|---|---|---|---|
| Supabase Inc. | Login, database and server functions | Account, company, membership, plan, usage metadata, device records and accepted risks | Hosted in |
| Cloudflare Inc. | Website hosting and content delivery | IP address and browser details in short-lived logs | Global network |
| Paddle.com Market Ltd | Reseller and merchant of record: checkout, payments, tax, invoices | Billing name, email, address, VAT number, payment details (we never see card numbers) | UK, with processing in the EU and US |
| Resend Inc. (if enabled) | Sending invitation and review-reminder emails | Recipient email address, company name, device labels, client names and due dates | US / EU |
To check assets and scan results for vulnerabilities, our servers download public data from the US National Vulnerability Database. Nothing about you or your assets is sent to it.
Scanning authorisation. You may only scan an IP address or asset once you have verified you control it (by publishing a token we give you in DNS or on the host). Scans discover live hosts, open ports and software versions and match them against public vulnerability data; they do not run exploits. An internal scan uses an agent you install that is licence-locked to your company and only scans the targets you have verified. You are responsible for only scanning systems you own or are authorised to test.
We don't sell personal data or use it for advertising. We may disclose data if the law requires it, or to protect our rights or the safety of others.
International transfers
Our main database is hosted in . Where a provider processes data outside the UK, we rely on UK adequacy regulations or the International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses.
How long we keep data
- Account and company data: while the account or company exists. When you delete it, we delete it within 30 days, and from backups within 90 days.
- Usage metadata: 24 months, then deleted or anonymised.
- Device records: until you delete them, or 24 months after the device was last reviewed.
- Accepted risks: until 24 months after they expire or are revoked.
- Review sign-offs: 36 months, as audit evidence.
- Client names and logos: until you delete them or the company.
- Assets, their matched vulnerabilities and alert settings: until you delete them or the company. Daily asset counts: 24 months. Monthly asset charge records: 6 years, for tax law.
- Billing records: Paddle and we keep invoices and transaction records for 6 years to meet tax law.
- Security logs: up to 30 days unless needed to investigate an incident.
- Messages and reports you send us: 24 months after they’re closed. Complaints: 3 years. Problem reports about pages: 12 months.
- Our admin activity log: 24 months. Personal data breach records: 6 years.
Your rights
Under UK and EU data protection law you can ask to access, correct, delete or receive a copy of your personal data, and to restrict or object to how we use it. You can update most details yourself under Account and delete your account under Account › Profile & security. For anything else, send a privacy request or email . We'll reply within one month.
If you're unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office (ico.org.uk) or your local data protection authority.
Security
Data is encrypted in transit and at rest. Access is restricted by role and by database row-level security, so one company can never read another's data. Two-factor sign-in is available for every account.
Visitor statistics
We count visits to our public pages (not the Workbench, scan, asset, account or admin pages) with Cloudflare Web Analytics, a cookie-free statistics service run by Cloudflare, which also hosts this website. It records the page, the site you came from, your country, browser and device type, and how quickly the page loaded. It doesn't use cookies or store anything on your device, and Cloudflare says it doesn't use your IP address or browser details to identify or follow you. Addresses carrying a code (such as referral, invitation or password reset links) are never counted. We don't count browsers that send Do Not Track or Global Privacy Control. Our legal basis is our legitimate interest in running and improving the site. Your firewall configurations are never sent to it.
Cookies and local storage
See our cookie notice.
Children
The Service is for business use and isn't directed at children under 16.
Changes
We'll post updates here and email account owners about significant changes.