Privacy Policy

VulnVerify, LLC (“we”, “us”) is a Delaware limited liability company and provides an external vulnerability scanning and vulnerability intelligence service used by customers globally. For the purposes of GDPR and similar regulations, we act as both data controller (for account data) and data processor (when handling content you submit through our service).

You can reach our team at contact@vulnverify.com or for privacy-specific matters at privacy@vulnverify.com.

We collect only data that is necessary to operate the service:

• Account data: your name, email address, hashed password, organization, and subscription tier.
• Domain and scan data: the domains you add, how each one's ownership was verified, the scan authorization for it — the name and job title of the person who gave it, when, and the version of the text they accepted — and the results of the scans we run. Section 6 describes this in full.
• Usage data: search queries, saved searches, watched vulnerabilities, alerts you configure, and the records you view. We use this to provide and improve the service.
• Billing data: for paid plans, we collect billing-related information via our payments processor. We never see or store your full card number.
• Technical data: IP address, browser user-agent, device type, and approximate region for security and rate-limiting.
• Disclosure contact data: where we notify an organization about a vulnerability affecting it, we process the business contact details of the people responsible for security there — name, job title, employer, and work email address. These people are not our customers and did not give us this data; it comes from a third-party business-contact provider. Section 7 sets out exactly how this works and how to stop it.

We use the data described above to: deliver the service, authenticate you, send transactional emails (verification, password reset, billing receipts), enforce per-tier usage limits, detect and prevent abuse, and improve the product.

We do not sell your personal data. We do not use your data to train third-party AI models. We do not share your search history, watchlists or scan results with anyone outside the VulnVerify team.

For users in the European Economic Area, UK, and other regions with similar regulations, our legal basis for processing your personal data is:

• Contract: to deliver the service you signed up for.
• Legitimate interests: to keep the service secure, prevent abuse, improve the product, and to notify an organization that a vulnerability affecting it has been found (see section 7). For that last purpose we have weighed our interest, and the recipient organization's own strong interest in learning about an exposure, against the limited privacy impact of using a work email address to reach the person whose job it is to receive exactly this kind of report.
• Consent: for optional marketing communications, which you can withdraw at any time.
• Legal obligation: where applicable, to comply with tax or law-enforcement requirements.

We use a small number of trusted sub-processors to operate the service. Each has been chosen for their security posture and contractual data-protection commitments:

• Stripe — payment processing for subscriptions. Card data is sent directly to Stripe (a PCI-DSS Level 1 processor); we receive only billing metadata (e.g. last 4 digits, billing country).
• Resend — transactional email delivery (verification, password reset, receipts, domain ownership links and scan-report notices).
• PostHog — product analytics. We track usage events only — never the content of your searches.
• Vercel— application hosting, content delivery, storage of the scan-report files we issue, and the cookieless page-view and page-speed telemetry described in section 10.
• Supabase — managed PostgreSQL database.
• Contabo — hosts our scan runner in the EU (Germany): the server that sends the scans you authorize, from the address published on our scanning page, and returns their results to us.
• Upstash— short-lived abuse-prevention counters. They are keyed on the caller's IP address for signup, sign-in, password reset, email verification, domain ownership verification emails, unsubscribe, the contact form and the public domain check, and on an internal account identifier when we ask you to confirm your password — changing it, or deleting your account — or when you re-check a domain's ownership proof. No names, email addresses, searches, watchlists or report content are sent.
• Anthropic — automated review of researcher-written vulnerability reports and extraction of findings from source material. Not used for your account data, your searches, your watchlists, or your scan results, and not used to train any model.
• Apollo.io— business-contact data, used only to identify who to notify about a vulnerability (section 7). Not used for customer data.
• BounceBan — email-deliverability checks on those disclosure addresses, so we do not send a security notice into a dead mailbox.
• Instantly.ai — delivery of vulnerability-disclosure notices. Not used for customer or transactional email.
• Google Workspace — our own email and internal documents. Disclosure notices are sent by Instantly.ai, above; they are not individually reviewed before sending.

Some of these providers are based in the United States. International transfers of personal data are governed by the EU Standard Contractual Clauses, as set out in our Data Processing Agreement. A current list of sub-processors is available on request to privacy@vulnverify.com.

Findings in your account come from two places: the authorized scans we run of domains you have verified, and our vulnerability-intelligence research. We never conduct unauthorized testing against any organization's infrastructure: a domain is scanned only after its owner has proven control of it and authorized the scan, under section 7 of our Terms of Service.

Scan results are your data. For each scan of a domain you have verified and authorized, we store when it ran and how it ended, the scanner and check versions it used, and how many hosts it found and checked. For every finding we store the host and path where it was observed, the check that found it, its severity and CVE and CWE references, a description and remediation advice, when it was first and last seen, whether a later scan found it fixed, and any status or note you set on it. A finding can also carry a short, size-limited excerpt of the request and response that shows it; our scanner redacts the credentials, keys and tokens it recognises before the excerpt leaves it. We also keep the reports we issue for each scan and the domain's authorization record: who gave it, their job title, when, how the domain was verified, and which version of the authorization text they accepted. This is information about your systems, processed on your behalf only to deliver the service, and our Data Processing Agreement covers it. We do not sell it, and we do not use it to train any AI model.

Tools you connect. If you connect Drata, Vanta, GitHub or your own webhook under Settings, we send that service the scan results, verified fixes, reports and monthly statements of your own domains — at your instruction, and only while your plan includes integrations. Nothing about another organization is ever sent. Those services are your vendors, not our sub-processors: what they do with the data is governed by your agreement with them. Their credentials are stored encrypted and are never shown back in full. Disconnecting stops further sends; it cannot recall what a service has already received.

Who can see them. Scan results for a domain are visible only to the account that verified and authorized it. They are not shown to other customers: two colleagues who each verify the same domain each see only their own scans. They never appear on our public pages, in the free domain check, in public statistics, or in the notices we send to organizations that are not our customers (section 7). Our staff open them only to operate the service, to investigate a problem, or to answer a request from you. A report you download is yours to share, and anyone you give it to can confirm that we issued it at vulnverify.com/verify/<the file's SHA-256>; that page shows the domain, the issue date, the kind of scan and its finding counts, never a finding.

Where scanner traffic comes from. Our scanner's source addresses are published on our scanning page, and every request it sends names VulnVerify in its User-Agent, so your team can recognise it in their logs. The same page sets out what the scanner does and does not do, and how to stop it.

How long we keep them. Scan results are kept while the domain is in your account. Removing the domain, or deleting your account, deletes its scans and every finding they produced; section 8 lists the two records that outlive a removed domain. The PDF file of each report we issued — which prints the findings and the name and job title of the person who authorized the scan — is held by our storage provider (Vercel, section 5) at an unguessable address the service never displays, and it is deleted from that storage in the same step. If the storage provider cannot be reached at that moment, we are alerted and delete the file by hand. Download any report you want to keep before you remove the domain. What remains of a report once its file is gone is its verification record in section 8, which carries no finding and no name. Questions about any of this go to privacy@vulnverify.com.

Our vulnerability intelligence. Findings from our research are collected from publicly-accessible sources — including hacking forums and exploit marketplaces, paste sites, ransomware leak sites, public exploit databases, and Telegram channels. Every finding from this research is manually verified by a security researcher with a working proof-of-concept before publication. Where a finding carries researcher attribution it is a pseudonymous handle (e.g. “VR-001”); a researcher's legal identity is never stored alongside a finding, and never leaves our team.

We deliberately omit specific forum or marketplace names from public records and external communications, both for source protection and to avoid drawing attention to those venues. The broad category (e.g. “exploit-marketplace,” “leak-site”) is recorded for each finding.

When we verify a vulnerability affecting an organization that is not our customer, we try to tell them about it. This section exists because the people we contact did not give us their details and are entitled to know how we got them — it is the notice required by Article 14 of the GDPR, and we give it to everyone we contact regardless of where they are.

What we process. Name, job title, employer, and work email address for people in a security, engineering, or IT-leadership role at the affected organization. We never request or use personal email addresses, home addresses, or telephone numbers, and we do not build a profile of the person beyond what is needed to address a single message correctly.

Where it comes from. Apollo.io, a commercial business-contact provider. Addresses are then checked for deliverability by BounceBan, and the notice is sent through Instantly.ai. We do not scrape the recipient's own website, social profiles, or any breached data set to build contact lists.

Why.To give an organization the chance to fix an exposure before it is exploited. Our legal basis is legitimate interests (Article 6(1)(f)); the balancing test is summarised in section 4. The message describes the finding and how to claim the full report. We contact an organization about a given finding once; how many messages that outreach contains, and when they are sent, is configured in the sending tool and is described by the unsubscribe options in the message itself.

How to stop it. Every disclosure message carries an unsubscribe link. It is handled by Instantly.ai, the provider that sends these messages on our behalf, and using it stops the sequence you are in — no further message from it will reach you. You can also email privacy@vulnverify.com and we will suppress your whole organization by hand — that is the route to use if you want every colleague covered, not only the address that received this message. There is no penalty for opting out: it does not affect anything else, and it does not remove the finding from our records — it only stops the messages.

What we keep. A record that a given organization was contacted about a given finding, with the addresses the notice went to, so that we can honour a suppression and never contact the same organization twice about the same thing. Suppressions are kept for as long as we operate the service, because deleting one would undo it. Every right in Your rights applies to this data, including the right to object to the processing and to lodge a complaint with your local data protection authority.

We keep your account data for as long as your account is active. Billing records are kept for the period required by US and other applicable tax law. Disclosure contact records and suppressions are covered by section 7.

Search history is capped, not timed: we keep your most recent searches and drop the oldest as new ones arrive, so the list stays at roughly two hundred entries. It is not deleted on a schedule. You can clear the whole history yourself at any time from your search history page, and it is deleted with your account.

Security audit logs — sign-ins, lockouts, billing events, admin actions and report downloads, each with the time, the IP address and the browser user-agent — are kept for as long as we operate the service. We do not currently delete them on a schedule.

When you delete your account, we delete your account record and the data attached to it — searches, saved searches, watchlists, alerts, API keys and subscription records — within 30 days, and in practice immediately. Audit-log entries are the one exception: the entry survives, and the IP address and user-agent captured at the time stay on it, because an audit trail that a user can erase is not an audit trail. Your account record is unlinked from those entries when it goes, and what can remain on one is an internal identifier for an account that no longer exists. An entry recording an action our staff took on your account — suspending it, lifting that suspension, or verifying its email address by hand — is recorded against the administrator who took it, and can still name the email address it was taken against. We may retain anonymized aggregate data indefinitely.

Removing a domain, or deleting your account, deletes the scans we ran for it, every finding they produced, and the PDF files of the reports we issued for it (section 6). Two records outlive a removed domain by design. For each scan report we already issued, we keep its SHA-256 fingerprint, the domain name, the issue date, the kind of scan and its finding counts — never a finding, host, path or your name — so that anyone you gave the report to can still confirm that we issued it at vulnverify.com/verify/<the file's SHA-256>; a report that stopped verifying the moment you left would be worthless to the auditor holding it. And until your account itself is deleted, we keep a note that it has had its free first scan of that domain, so that removing and re-adding a domain does not start another free report.

If you are in a region with applicable privacy laws (including the EU, UK, and California), you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Erase your data (the “right to be forgotten”).
• Export your data in a portable format.
• Object to or restrict certain processing.
• Withdraw consent at any time where consent is the basis.
• Lodge a complaint with your local data protection authority.

Email privacy@vulnverify.com to exercise any of these rights. We respond within 30 days.

We use strictly-necessary cookies for authentication and session management. Product-usage analytics (via PostHog) are collected server-side and keyed to your account — no analytics cookies are set, and we record usage events, not the content of your searches. Page-view and page-speed telemetry (Vercel Web Analytics and Speed Insights) is collected in your browser, also without cookies and without fingerprinting.

We do not use third-party advertising or tracking cookies.

Data is encrypted in transit (TLS 1.2+) and at rest. Passwords are hashed with bcrypt at cost factor 12; sign-in is rate-limited and accounts lock out after repeated failures. Database credentials live only in our hosting platform's encrypted environment configuration, never in source control. Every query that reads findings is scoped to the domains your account is bound to or has proven it controls, and scan results to the account that authorized the scan. Every change is gated on typecheck, lint and an automated test suite before it ships.

We run a responsible-disclosure address for reports about VulnVerify itself. We have not yet completed an external security audit or a SOC 2 examination; where we stand on each framework is published on our security page.

In the unlikely event of a personal-data breach affecting you, we will notify you and the relevant supervisory authority within 72 hours, in line with GDPR requirements.

Because we are a US company serving customers globally, your data may be transferred to, and processed in, countries outside your home jurisdiction. When transferring data internationally, we rely on Standard Contractual Clauses or equivalent safeguards as required by the GDPR.

We may update this policy from time to time. Material changes will be announced via email and on this page. The “Last updated” date at the top reflects the most recent revision.

Email privacy@vulnverify.com for privacy questions or contact@vulnverify.com for anything else.