Loading page content
This is a plain-language summary of current technical behavior. It is not a Privacy Notice, Terms of Service, Data Processing Agreement, service-level agreement, legal guidance, or a promise of legal compliance.
A quick report retrieves a user-submitted public HTTPS target and attempts eligible public pages during a bounded first visit. It does not select consent choices. The report record retains the submitted target, scan state, timing, and bounded automated evidence summary.
When the approved privacy notice is configured, a visitor may optionally share a work email, name, and company after a scan starts. Skipping this prompt does not stop or reduce the scan. Submitted contact details are stored with the quick-report record to respond about the report, with a separate optional marketing choice, and are deleted with that record under the same retention controls.
The requesting client address is replaced with a keyed pseudonym. A referrer origin and bounded recognised campaign values may be retained; full referrer paths and query strings are not stored, and the user-agent string is not retained.
The current technical policy deletes pseudonymous quick-report rows after 30 days and keeps at most 25 recent rows for each keyed client pseudonym.
A quick-report URL can be opened by anyone who has it. Do not submit a target URL containing secrets or share a report URL more widely than intended.
A workspace can retain account and membership records, registered websites, scan configuration, findings, reports, screenshots, consent evidence, and audit records needed for the product workflows in use.
Production requires approved finite retention periods for scan evidence and reports. Evidence from authenticated scans is limited to seven days, and authenticated screenshots are disabled. Legal holds can preserve otherwise eligible records; plan-specific periods still require approval.
An evidence archive is a download, not deletion. An account export action records a request rather than producing an immediate download. Account deletion is a reviewed workflow and legal holds can preserve otherwise eligible records.
Workspace access is scoped by account, role, and—where configured—website assignment. Security-sensitive actions can require recent multi-factor verification.
Current session defaults include a seven-day hard expiry and a 30-minute idle expiry. Remembered multi-factor devices expire after 30 days and can be revoked.
Authenticated scan login scripts are encrypted operational inputs. Passwords, MFA codes, API keys, session cookies, login scripts, and private report links should not be placed in support messages.
The implementation supports external services for transactional email and error monitoring. The public subprocessor list, processing-region choices, international-transfer position, and customer notice process still require owner and legal approval.
This page therefore makes no data-residency, transfer-mechanism, uptime, service-level, or certification assurance.
The repository does not contain owner- and legal-approved versions of the following public documents. They should only be published after the responsible owners supply the missing identity, jurisdiction, contact, processing, and contractual decisions.