Privacy Notice

We process account details, organisation membership, domains you submit, scan results, assessment answers, remediation records, reports, and security audit events. We also process ordinary service logs needed to operate and protect the application.

We use this information to authenticate users, run requested scans, calculate readiness indicators, generate reports, support monitoring, prevent abuse, and diagnose service failures.

The deployment uses Supabase for authentication and data storage, Vercel for the web application, and any report AI provider configured by the operator. Data remains until an authorised organisation user deletes it or the operator removes it under the applicable retention process. Expiring share and invitation links have their own expiry dates.

Authorised users can review and export organisation data in the application. Requests for access, correction, deletion, or privacy questions should be sent through the support contact published for the deployment.