Privacy Policy

Vulnsy ("we", "us") is the business that provides the Vulnsy penetration test reporting platform, and is the controller of the account data described in this policy. The policy covers the website at vulnsy.com, the hosted service (your workspace at a vulnsy.com subdomain or your own domain) and the limited data we handle for the self-hosted edition.

If you have a question about this policy or want to exercise your rights, email luke@vulnsy.com.

We treat two categories differently, and it helps to keep them apart.

• Account data: details about you as our customer or prospect, such as your name, work email, company and plan. We decide how this is used, so we are the controller.
• Workspace content: everything you put into a workspace, such as clients, projects, findings, reports and evidence. You decide what goes in and who sees it. You are the controller and we process it only to provide the service to you.

• Trial requests and accounts: name, work email, company name, company size, chosen workspace name and plan.
• Sign-in data: a salted hash of your password, or an identifier from Google or Microsoft if your organisation enables single sign-on. We never see your SSO password.
• Billing: your plan, subscription status and invoice history. Card details go straight to our payment provider and never reach our servers.
• Messages: emails you send us and anything you submit through the contact form.
• Technical data: IP address, browser type and request logs, used to keep the service secure and to limit abuse of public forms.
• Website analytics: pages viewed and referring sites on vulnsy.com, described under Cookies below.
• Self-hosted licensing: company name, contact name, work email and the instance ID of an install when a license is requested, and a record of each package download. A self-hosted install checks its license offline and sends us nothing about your users or your content.

• To review trial requests, create your workspace and run the service.
• To bill you and manage your subscription.
• To answer your questions and provide support.
• To keep the service secure, investigate abuse and meet legal obligations.
• To understand in aggregate how the website is used so we can improve it.

We do not sell personal data, and we do not use workspace content to train AI models.

The AI writing assistant is optional and off until an administrator enables it. When you use the managed option, requests are sent from our servers to model providers configured not to retain or train on your data. Client names, domains and hosts are replaced with placeholders before a request is sent, unless an administrator turns that off. We do not store your prompts or the generated text; we record token counts so usage can be metered.

If you connect your own provider key or your own model endpoint instead, requests go to the provider you chose under your agreement with them.

Where UK or EU data protection law applies, we rely on:

• Contract: to provide the service you asked for, including trials and billing.
• Legitimate interests: to secure the service, prevent abuse, answer enquiries and improve the product.
• Consent: for analytics or advertising cookies where the law requires it. You can withdraw consent at any time.
• Legal obligation: for tax and accounting records.

We use a small number of providers to run the service. Each handles data only on our instructions.

• Vercel: application hosting and delivery.
• Neon: PostgreSQL databases. Each workspace has its own isolated database.
• Amazon Web Services: file storage for evidence, images and report templates.
• Stripe: payments and subscription billing.
• Resend: transactional email such as invitations and password resets.
• OpenRouter: model access for the managed AI assistant, only when it is enabled.
• Google and Microsoft: single sign-on, only if your organisation enables it.
• Google Analytics, Google Ads and Simple Analytics: measurement on the marketing website only, never inside a workspace.
• Have I Been Pwned: when you set a password we check it against known breaches by sending the first five characters of its hash. The password itself never leaves our servers.

We may also disclose data when the law requires it, or to a successor if the business is sold, under the same commitments as this policy.

Workspace databases and files are hosted in the United States. Where personal data is transferred outside the United Kingdom or the European Economic Area, we rely on appropriate safeguards such as the standard contractual clauses our providers offer.

If you need your data kept on your own infrastructure, the self-hosted edition runs entirely on servers you control.

• Workspace content: for as long as your subscription or trial is active. After it ends, the workspace is deleted following a short period that lets you export your data or resubscribe.
• Trial requests that are not approved: deleted once they are no longer needed to handle the request.
• Billing records: for as long as tax and accounting law requires.
• Server logs: for a limited period, for security and troubleshooting.

Items you delete inside a workspace go to its trash first, where an administrator can restore them, and are removed for good when the trash is emptied.

• Each workspace has its own database, so one customer cannot query another customer’s data.
• All connections are encrypted with TLS.
• Access inside a workspace is role-based, down to individual clients and reports.
• Passwords are stored as salted hashes, and API keys and stored credentials are hashed or encrypted.

No system is perfectly secure. If we become aware of a breach affecting your data we will tell you without undue delay.

Inside a workspace we use only the cookies needed to keep you signed in and remember your preferences.

On the marketing website we use Google Analytics and Google Ads conversion measurement, which set cookies, and Simple Analytics, which does not. You can block cookies in your browser without losing access to any part of the site.

Depending on where you live, you may have the right to access, correct, delete or export your personal data, and to object to or restrict how we use it.

For account data, email luke@vulnsy.com and we will respond within one month. For workspace content, please ask the administrator of the workspace first, because they control it; we will help them respond.

If you are unhappy with how we handle a request you can complain to your data protection authority. In the United Kingdom that is the Information Commissioner’s Office.

When we change this policy we update the date at the top. If a change materially affects how we use your data, we will tell workspace administrators by email before it takes effect.