Privacy Policy

VulnVerify, LLC (“we”, “us”) is a Delaware limited liability company and provides a vulnerability intelligence service used by customers globally. For the purposes of GDPR and similar regulations, we act as both data controller (for account data) and data processor (when handling content you submit through our service).

You can reach our team at contact@vulnverify.com or for privacy-specific matters at privacy@vulnverify.com.

We collect only data that is necessary to operate the service:

• Account data: your name, email address, hashed password, organization, and subscription tier.
• Usage data: search queries, saved searches, watched vulnerabilities, alerts you configure, and the records you view. We use this to provide and improve the service.
• Billing data: for paid plans, we collect billing-related information via our payments processor. We never see or store your full card number.
• Technical data: IP address, browser user-agent, device type, and approximate region for security and rate-limiting.

We use the data described above to: deliver the service, authenticate you, send transactional emails (verification, password reset, billing receipts), enforce per-tier usage limits, detect and prevent abuse, and improve the product.

We do not sell your personal data. We do not use your data to train third-party AI models. We do not share your search history or watchlists with anyone outside the VulnVerify team.

For users in the European Economic Area, UK, and other regions with similar regulations, our legal basis for processing your personal data is:

• Contract: to deliver the service you signed up for.
• Legitimate interests: to keep the service secure, prevent abuse, and improve the product.
• Consent: for optional marketing communications, which you can withdraw at any time.
• Legal obligation: where applicable, to comply with tax or law-enforcement requirements.

We use a small number of trusted sub-processors to operate the service. Each has been chosen for their security posture and contractual data-protection commitments:

• Stripe — payment processing for subscriptions. Card data is sent directly to Stripe (a PCI-DSS Level 1 processor); we receive only billing metadata (e.g. last 4 digits, billing country).
• Resend — transactional email delivery (verification, password reset, receipts).
• PostHog — product analytics. We track usage events only — never the content of your searches.
• Vercel — application hosting and content delivery.
• Supabase — managed PostgreSQL database.

Some of these providers are based in the United States. International transfers of personal data are governed by the EU Standard Contractual Clauses, as set out in our Data Processing Agreement. A current list of sub-processors is available on request to privacy@vulnverify.com.

VulnVerify is a defensive threat-intelligence service. Our findings are collected from publicly-accessible underground sources — including dark-web forums and marketplaces, paste sites, ransomware leak sites, public exploit databases, and Telegram channels. We never conduct unauthorized testing against any organization's infrastructure.

Every finding is manually verified by a security researcher with a working proof-of-concept before publication. We retain a pseudonymous researcher handle (e.g. “VR-001”) for audit attribution; the researcher's legal identity is never stored alongside findings.

We deliberately omit specific forum or marketplace names from public records and external communications, both for source protection and to avoid drawing attention to underground venues. The broad category (e.g. “underground-forum,” “exploit-marketplace”) is recorded for each finding.

We keep your account data for as long as your account is active. Search history is kept for 90 days. Audit logs are kept for 12 months. Billing records are kept for the period required by US and other applicable tax law.

When you delete your account, we remove personal data within 30 days. We may retain anonymized aggregate data indefinitely.

If you are in a region with applicable privacy laws (including the EU, UK, and California), you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Erase your data (the “right to be forgotten”).
• Export your data in a portable format.
• Object to or restrict certain processing.
• Withdraw consent at any time where consent is the basis.
• Lodge a complaint with your local data protection authority.

Email privacy@vulnverify.com to exercise any of these rights. We respond within 30 days.

We use strictly-necessary cookies for authentication and session management. Product-usage analytics (via PostHog) are collected server-side and keyed to your account — no analytics cookies are set, and we record usage events, not the content of your searches.

We do not use third-party advertising or tracking cookies.

Data is encrypted in transit (TLS 1.2+) and at rest. Passwords are hashed with bcrypt. Database access is restricted to authenticated services in a private network. We follow secure development practices and undergo periodic external review.

In the unlikely event of a personal-data breach affecting you, we will notify you and the relevant supervisory authority within 72 hours, in line with GDPR requirements.

Because we are a US company serving customers globally, your data may be transferred to, and processed in, countries outside your home jurisdiction. When transferring data internationally, we rely on Standard Contractual Clauses or equivalent safeguards as required by the GDPR.

We may update this policy from time to time. Material changes will be announced via email and on this page. The “Last updated” date at the top reflects the most recent revision.

Email privacy@vulnverify.com for privacy questions or contact@vulnverify.com for anything else.