Registration and confirmation.
We store company name, contact name, email, optional phone number, target domain, language, the time and version of the testing request, and your authorizations. A hashed one-time link verifies your mailbox and expires after 30 minutes. Unverified requests are removed after seven days. Event registrations record the event and confirmed venue, not ticket images or exact coordinates. Browser push is optional; its delivery information can be revoked.
For additional domains we store the TXT challenge, verification time and your authorization for automated checks. Manually added hostnames are marked in the inventory. Free technical results are reused per domain for up to 30 days; customer contacts stay separate.
Public data and bounded checks.
The check uses our existing scanners for public certificate, archive and DNS data. The domain is sent to the relevant data sources. Bounded automated subdomain-takeover, XSS and open-redirect checks run only with explicit authorization. No accounts or cloud resources are claimed.
Reports and recommendations.
Your results are available in your company area. A referral partner sees contact data, sales status and the provisional offer value only with your permission. You can withdraw this permission in the report. Existing data export and deletion features are also available in the company area.
Transactional email through Postmark.
We use Postmark for confirmation links and sign-in codes. The recipient address, subject and message content are sent to the delivery service. Open and link tracking are disabled. In local development, test emails are stored only in the development mailbox.
The controller address, privacy contact and final information for public operation still need to be supplied. This description explains the implemented workflows and is not yet a complete privacy notice.