Privacy Policy
Last updated: 1 October 2026
SecurityTrackr ApS, registered in Denmark under CVR no. 46602846.
1. Who we are
The Service is operated by SecurityTrackr ApS, a company registered in Denmark under CVR no. 46602846 (“we”, “us”, “our”), the data controller for personal data processed through this Service.
For privacy-related enquiries, including data subject rights requests, contact us at: support@securitytrackr.com. Routine transactional emails (email verification, password reset, team invitations, billing notifications) are sent from noreply@securitytrackr.com and are not monitored for inbound replies.
Where your organisation invites multiple users to the Service, your organisation is the controller of those users' data within the organisation and we act as a processor on its behalf. That processing is governed by our Data Processing Agreement (DPA), which sets out our obligations under Article 28 GDPR together with the details of the processing, our technical and organisational security measures, and our sub-processor list. The DPA is incorporated into our Terms of Service and applies automatically to every organisation — no signature is required for it to be in force. Request a copy, or an executed counterpart for your records, at support@securitytrackr.com.
2. What data we collect
Account and organisation data
To run your account we store your name and work email, your authentication method and role, and account dates (creation, last sign-in, email verification, Terms acceptance). For email-and-password accounts we also store a securely hashed version of your password — never the plaintext — and your two-factor authentication secrets in encrypted form. Where your organisation uses Single Sign-On, we store the identifiers and the email and name your identity provider returns.
For your organisation we store its profile (name, industry, country, size, chosen regulatory frameworks), any optional details you add (domains, IP ranges, website, social links, logo and brand colour), your billing and subscription state, and your AI and Single Sign-On configuration. Each organisation's data is protected with its own encryption key, which is itself kept encrypted under a separate master key held outside the main database.
Your content
The free-text content of your security observations, your discussion comments, your evidence files (including their filenames), and any saved diagrams or generated reports is encrypted at rest with your organisation's own key using strong, industry-standard encryption, and is accessible only to authenticated members of your organisation. Operational metadata we need in cleartext to list, filter, and report on observations — identifiers, category, status, treatment, risk rating, likelihood, impact, NIST CSF areas, assignee, and timestamps — is stored unencrypted but contains none of the free-text content. Our activity log records the filename an action applied to in cleartext, so that the log remains readable to your administrators.
To screen for malware, a digital fingerprint (hash) of each uploaded file is sent to a third-party lookup service (see section 6); the file and its contents are never sent.
AI provider API keys (BYOK)
If you use the AI features with your own API key (BYOK), that key is encrypted with your organisation's key and used only to fulfil AI requests you explicitly trigger. The provider you chose (Anthropic, OpenAI, or Mistral) then processes that request under your own agreement with them, not as our sub-processor (see section 6).
Audit logs and technical data
We keep an audit log of security-relevant actions (sign-ins, multi-factor changes, observation and evidence changes, billing events). Each entry records the user's name, email, action, timestamp, IP address, and a small details object — never the encrypted content itself. We also process your IP address and request headers in transit for routing, rate limiting, and abuse prevention; request headers are not persisted. Cookies are described in section 7.
3. Data we collect from sources other than you
When you sign up with a work email, we send the email's domain (not the full address) to a built-in AI service to identify your organisation and draft a short profile of it: its industry, country, approximate size, public website, and a brief description of what it does. When the service is confident it has identified your organisation, these details are saved to your new organisation so you don't have to enter them by hand; you can review and change them at any time in your organisation settings. Free consumer email domains (for example gmail.com) are skipped, and if the service is not confident, your organisation is left blank for you to complete yourself.
When you use the optional OSINT enrichment integration (currently powered by Shodan, LLC) to enrich a finding, we query the OSINT provider using IP addresses or hostnames you provide. The provider returns the publicly indexed exposure data it already holds for those targets, which is then stored against the finding in your organisation.
4. How we use your data
We use your data solely to provide and improve the SecurityTrackr Service:
- Authenticating you and securing your account
- Storing and displaying your security observations and evidence
- Sending transactional emails (email verification, password reset, team invitations, billing notifications)
- Generating AI-assisted content when you explicitly request it
- Maintaining an audit trail for your organisation
- Processing payments via our billing partner
- Protecting the Service against abuse, fraud, and unauthorised access
- Complying with our legal obligations
We do not sell your data, use it for advertising, profile you for marketing purposes, or share it with third parties for any purpose other than those described in this policy. We do not perform automated decision-making with legal or similarly significant effects on you within the meaning of Article 22 GDPR. AI-generated content is offered as a drafting aid for human review and is not a decision about you.
5. Legal basis for processing (GDPR)
- Performance of a contract — processing necessary to provide the Service you have signed up for, including authentication, storing your observations, sending transactional emails, processing AI requests you explicitly trigger, and billing (Article 6(1)(b))
- Legitimate interests — security logging, rate limiting, abuse prevention, malware-reputation checks on uploaded evidence, and securing our infrastructure. We have assessed that these interests are not overridden by your interests or rights given the limited data involved and the security purpose served (Article 6(1)(f))
- Legal obligation — where we must process data to comply with applicable law, for example tax record retention or responding to lawful authority requests (Article 6(1)(c))
Providing the account and organisation data needed to create and run your account is a contractual requirement; without it we cannot provide the Service. The other data described above is optional and you can choose not to provide it.
6. Sub-processors and international transfers
We use a small number of sub-processors to deliver the Service. The current list is below. Where a sub-processor is based outside the European Economic Area (EEA), or where it is established in the EEA but its parent is subject to third-country jurisdiction, transfers are made under appropriate safeguards including the European Commission's Standard Contractual Clauses (SCCs), the EU-US Data Privacy Framework where applicable, and supplementary technical measures (notably our application-layer encryption of sensitive Customer Content). A copy of the relevant transfer mechanism is available on request.
| Sub-processor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Cloud hosting, database, file and object storage, content delivery, DDoS protection, logging, internal usage metering, and the built-in AI (Cloudflare Workers AI) used on the Free plan and for the signup organisation-profile draft | EU region (data stored at rest); AI and edge processing on Cloudflare's global network; US (corporate) |
| Google Ireland Limited (Google Workspace) | Transactional email delivery via the Gmail API (verification, password reset, invitations, billing notifications) and the support@ mailbox | EU / US |
| Anthropic, PBC | AI text generation for the “Advanced AI” tier included with paid plans — the default provider, chosen for output quality — where we hold the API key on your behalf. Anthropic processes the request in the United States under our Data Processing Agreement and Zero Data Retention agreement: inputs and outputs are not retained beyond generating the response and are not used to train its models. Only invoked when you explicitly trigger an AI feature. Organisations that require EU processing can switch the Advanced AI tier to Mistral (next row) in Account settings, and organisations that standardise on GPT can switch it to OpenAI (the row after that). On the Free plan, AI text generation runs on the built-in AI service instead (see the Cloudflare row above); semantic matching's embeddings run on Mistral on every plan (next row). | US |
| Mistral AI | AI text generation for the “Advanced AI” tier when an organisation selects Mistral for EU data residency, where we hold the API key on your behalf. Mistral is a European (France-based) provider and processes the request in the EU under a Data Processing Agreement; we have Zero Data Retention enabled, so Mistral does not store your inputs or outputs beyond generating the response, and does not use them to train its models. Only invoked when you explicitly trigger an AI feature. Mistral also provides the embeddings used for semantic matching (finding related and duplicate observations by meaning) on every plan, regardless of which provider the organisation uses for generation. The same Zero Data Retention terms apply whenever embeddings run. Semantic matching can be switched off per organisation under Account → AI. | EU (France) |
| OpenAI, L.L.C. | AI text generation for the “Advanced AI” tier when an organisation selects OpenAI in Account settings — the option for organisations that standardise on GPT — where we hold the API key on your behalf. OpenAI processes the request in the United States under our Data Processing Agreement, and does not use data submitted via its API to train its models. Only invoked when you explicitly trigger an AI feature. Unlike Anthropic and Mistral, we do not hold a Zero Data Retention agreement with OpenAI: its standard API terms keep a limited retention window for abuse monitoring rather than retaining nothing. If zero retention is your requirement, select Anthropic; if you also require EU processing, select Mistral. | US |
Billing and payments. Stripe Payments Europe, Limited and the Stripe affiliates providing the applicable services, including Sold through Link, LLC for Managed Payments, process billing, payment, and tax data in the EU and US. This is separate from processing Customer Content on your organisation's behalf: SecurityTrackr acts as controller for billing and account administration. Stripe acts as a processor where it processes data on our instructions, and as an independent controller for purposes it determines, including fraud prevention and compliance with financial and tax obligations. Its processing is governed by the applicable Stripe services terms and incorporated Stripe DPA, and, for its controller activities, the Stripe Privacy Policy. Checkout runs on Stripe's hosted pages; we do not receive or store payment card numbers. Charges appear on card statements as LINK.COM* SecurityTrac.
Integrations that receive no personal data. Two third-party services receive only non-personal technical data, so they are not personal-data sub-processors: a malware-lookup service (VirusTotal, operated by Google) receives a digital fingerprint (hash) of an uploaded evidence file — never the file or its contents — to check it for known malware; and our OSINT provider (currently Shodan, LLC) receives the IP addresses or hostnames you enter as lookup targets when you trigger an enrichment. Neither receives personal data about you or your users.
Bring Your Own Key (BYOK). If you configure the AI features with your own API key (Anthropic, OpenAI, or Mistral), that provider is engaged underyour own agreement with them, not as our sub-processor. We pass your prompt to the provider you chose using the key you supplied; their handling of that data is governed by your contract with them.
We will give at least thirty (30) days' notice of any new or replacement sub-processor that processes Customer Content, by email to your registered administrative contact and by updating the list above. Where your organisation uses the Service as a controller, our Data Processing Agreement gives you a right to object to a new sub-processor on reasonable data protection grounds. This applies to every organisation — it does not depend on having signed a separate copy of that agreement.
7. Cookies
We use only strictly necessary cookies required for the Service to function. We do not use analytics, advertising, or third-party tracking cookies. Because all cookies are strictly necessary, no consent banner is required under the EU ePrivacy Directive.
| Cookie | Purpose | Duration |
|---|---|---|
Session cookie (__Host-authjs.session-token) | Keeps you signed in between page loads | 24 hours |
sso_state, sso_nonce, sso_verifier, sso_org | CSRF protection and binding during the SSO sign-in flow | Cleared when the SSO flow completes (typically minutes) |
8. Data retention
We retain personal data for the periods set out below. After the applicable period, data is deleted or irreversibly anonymised.
| Data category | Retention period |
|---|---|
| Account, organisation, observation, comment, and report data | For as long as your account is active. Permanently and irreversibly deleted from the live application database in the same request when you delete your account or organisation from the in-product Account settings page. |
| Evidence files and uploaded logos (object storage) | Same as account data. Removed from object storage as part of the same deletion flow. |
| Audit logs | Retained for 180 days (approximately six months) by an automated retention sweep, supporting your obligations to maintain a security audit trail. Exportable at any time within that window for ingestion into your own SIEM. Deleted with the account if that comes sooner. |
| Unverified signups | If no member of a newly-created organisation verifies their email within a short window (currently 3 days), the organisation and its data are automatically purged. |
| Session tokens and revocation records | Sessions expire after 24 hours. Revocation records expire automatically thereafter. |
| Email verification and password-reset codes | Maximum 15 minutes; deleted on use or expiry. |
| Rate-limit counters | Window-bound (typically 1–15 minutes); auto-expired. |
| Billing and tax records | Retained for the period required by applicable tax and accounting law (typically up to 5 years in Denmark) after account closure. |
| Encrypted offline database backups | Monthly backups are kept on offline media under SecurityTrackr's control in Denmark solely for disaster recovery, for no more than 12 months from creation. All offline copies, including any annual copy, have the same maximum retention; no indefinite archive is kept. Deleted personal data may remain in an older backup until that copy is deleted. Access is restricted to authorised personnel. Before restored data is made available through the Service, applicable deletions and restrictions must be reapplied. These backups cover the application database, not evidence files or images in object storage. |
| Database point-in-time recovery snapshots | Cloudflare D1 retains point-in-time recovery snapshots of the application database for up to 30 days. Deletions of live data propagate as those snapshots roll forward and are fully aged out within that window. Object storage (R2) and the key-value store (KV) do not maintain a customer-recoverable backup tier — deletions there are immediate. |
9. Your rights
Under GDPR you have the right to:
- Access — request a copy of the personal data we hold about you
- Rectification — correct inaccurate data (most can be updated directly in the app)
- Erasure — request deletion of your account and all associated data
- Portability — receive your data in a structured, machine-readable format
- Restriction — ask us to limit processing in certain circumstances
- Objection — object to processing based on legitimate interests
Contact us at support@securitytrackr.com to exercise any of these rights. We will respond within one (1) month of receipt of your request. Where a request is complex or where we have received a number of requests from you, we may extend that period by up to two further months and will inform you of any extension within the first month, with reasons.
If your personal data has been entered into the Service by an organisation that uses SecurityTrackr (for example your employer), please direct rights requests to that organisation in the first instance, as they are the controller of that data and we act as their processor.
You also have the right to lodge a complaint with your national data protection authority. The Danish supervisory authority is Datatilsynet.
10. Data security
We apply appropriate technical and organisational measures to protect your data, including strong, industry-standard encryption of sensitive content with a per-organisation key, encryption in transit, mandatory two-factor authentication, strict separation between organisations, rate limiting, and audit logging. Our security page describes these measures in more detail.
No security measure is perfect. We do not guarantee absolute security and you acknowledge this in our Terms of Service.
11. Personal data breaches
In the event of a personal data breach affecting your data, we will notify you without undue delay where required by Article 34 GDPR. Where the breach is likely to result in a risk to the rights and freedoms of natural persons, we will also notify the Danish supervisory authority within 72 hours of becoming aware, in accordance with Article 33 GDPR.
12. Children
The Service is offered for business use only and is not directed at children. We do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with personal data, please contact us so we can delete it.
13. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes we will notify you by email and update the “last updated” date above. Continued use of the Service after changes take effect constitutes acceptance of the updated policy. If you do not agree to the changes, your remedy is to stop using the Service and delete your account.