Privacy policy

We collect the minimum needed to run our own business:

• Business contact details you give us — name, work email, company, role.
• Account and authentication records, including SSO identifiers and sign-in events.
• Billing records. Card details are handled by our payment processor and never stored by us.
• Product usage events — which features were used, when, from which tenant.
• Support correspondence.

Our product analytics are aggregate and tenant-scoped. We do not use customer content, findings or evidence to train models, and we do not benchmark across tenants.

When a customer runs a scan, Vulnetra processes the data necessary to produce findings:

• Asset inventory: domains, hosts, IP addresses, service fingerprints.
• Findings: title, severity, CVSS vector, affected asset, remediation.
• Evidence: reproduction requests, responses and attachments supplied by customers or testers.
• Audit records: which user did what, and when.

We process this data only on documented instructions from the customer, including the configuration of the scan scope. We do not sell it, and we do not use it for our own purposes.

Retention is deliberately short for transient data and deliberately long for proof. Raw scanner traffic and captured credentials are discarded immediately after a finding is verified. Findings, evidence and the audit trail are retained for seven years, which is the period our customers typically need for audit and contractual evidence.

Business contact records are retained for the duration of the relationship and three years after. Billing records are kept for eight years to satisfy statutory retention requirements.

Customers choose a region at signup: EU (Frankfurt) or US (Virginia). Data, backups and replicas stay in the chosen region. A small amount of operational metadata — billing, support correspondence — is processed centrally.

Enterprise customers can run Vulnetra entirely inside their own cloud account, in which case no customer data reaches our infrastructure at all.

Our subprocessors are listed publicly with the data each one handles. We give 30 days notice before adding or replacing a vendor, and you can object on data protection grounds.

We also disclose data where legally required — a valid court order or a confirmed obligation to a regulator — and will tell you unless prohibited from doing so. We do not sell personal data, and we have never done so.

Depending on where you live, you may have the right to access, correct, delete, restrict or port your personal data, and to object to processing. For data we hold as a controller, exercise these rights by emailing privacy@vulnetra.io; we respond within 30 days.

For data a customer has placed in Vulnetra, we will route your request to that customer, who is the controller for it. If they ask us to act as processor, we will assist.

You may also lodge a complaint with your supervisory authority. We would rather you told us first.

We hold customer data under encryption at rest and in transit, with tenant isolation, least-privilege access, phishing-resistant MFA and an immutable audit trail. The control set is published in our trust centre, and the platform is independently audited under SOC 2 Type II and ISO 27001.

No system is perfect. If we discover a breach affecting your data, we will notify you without undue delay and within the timescales set by applicable law, with the facts we know and what we are doing.

Vulnetra uses a first-party session cookie to keep you signed in, and a strictly necessary cookie to remember your tenant context. We do not run advertising cookies and we do not embed third-party trackers on our marketing site.

Vulnetra is not directed at children under 16 and we do not knowingly collect their personal data.

If we make a material change to this policy we will notify customers in-product and by email at least 14 days before it takes effect. Previous versions are available on request.

Questions, requests or complaints: privacy@vulnetra.io.