Privacy and Data Policy

Account data: your name, email and organization.

Project data: repository references, the source code and artifacts you submit for analysis, and the findings produced.

Usage data: analyses run, scanners used, cost and token usage of any external LLM you configure, and audit events.

Technical data: session and security logs needed to operate the platform.

Providing the analysis service and managing your account: performance of the contract between us.

Billing paid plans and keeping accounting records: performance of the contract, and compliance with a legal obligation.

Securing the platform, preventing abuse and keeping audit logs: our legitimate interest in operating a service that is not misused.

Improving the platform and its security models from anonymized analysis data: our legitimate interest, and on the free Starter plan the consideration for a service supplied at no monetary cost, accepted when the account is created. You can object to processing based on legitimate interest at any time using the contact below.

We measure traffic on the public pages of cybseco.com using Plausible Insights OÜ (Plausible Analytics), acting as our processor for aggregate traffic measurement for the public pages of cybseco.com. It is not used on the signed-in application: the measurement script exists only in the published marketing pages, and is absent from the application, from the sign-in and sign-up pages and from every link sent by email.

What it receives for a page view: the address of the public page, the referring site, any campaign parameters in the link you followed, and the usual technical details of an HTTP request, including your IP address and browser user agent.

What it does with them: the provider states that the IP address and the user agent are never stored. They are combined with the site domain and a salt that is replaced and destroyed every 24 hours to derive a counter that distinguishes one visit from another within a single day, and no longer. No cookie is set, the provider writes nothing to your device, and no identifier is kept that would let either us or the provider recognise you on a later visit.

What it never receives: your email address, your account, your organisation, your repositories, your source code, any finding, and the address of any page inside the application. Page addresses are sent without their query string, so a link that carries a one-time token — verifying an email, resetting a password, accepting an invitation — cannot pass that token on; those pages are not measured at all.

What WE keep, separately and on our own side: when you arrive on a public page we record in your browser tab which page you landed on, a single word for the kind of source you came from, and any campaign parameters in the link. It is held in the tab's session storage, contains no identifier of any kind, is erased when you close the tab, and exists for one purpose — if you create an account, it is sent once with the sign-up so we know which channel the organisation came from. The referring address itself is read once in your browser to work out that single word and is then discarded: it is never sent to us and never stored.

If your browser sends a Do Not Track or Global Privacy Control signal, nothing is sent. We do not record the fact that you opted out either.

Västriku tn 2, 50403 Tartu, Estonia. Registry code 14709274. Data is processed on infrastructure located in the European Union.

Analysis data and the associated records are retained for up to 10 years, unless you delete a project or request erasure sooner. You can purge project data at any time from the governance settings.

Cybseco also collects anonymized information from analyses to improve its own security models. Two levels apply. A minimum, aggregate signal (statistics such as languages and severity counts, with no code and no sensitive content) is always collected and is accepted when you create an account. A larger, anonymized corpus of redacted findings is collected by default and, on paid plans, can be disabled per organization and per scan. Secrets, credentials, emails, IP addresses and file paths are stripped before storage, and all training data is encrypted at rest.

On the free Starter plan, this anonymized training collection is part of how the free plan is funded and cannot be disabled. If you need to disable it, use a paid plan (Pro or Ultimate).

Sensitive data is encrypted at rest and in transit. Access is restricted and audited.

The production infrastructure is hosted at Nuremberg, Germany with Hetzner Online GmbH, whose data center parks at that location are covered by an ISO/IEC 27001:2022 certification. That certification is held by Hetzner Online GmbH, not by us: it covers the hosting infrastructure, not the Cybseco service or its publisher.

Hosting: Hetzner Online GmbH, which operates the production server at Nuremberg, Germany. Your account, project and analysis data are stored there, inside the European Union.

Payments: Stripe, which processes card payments, subscriptions, tax determination and invoicing for paid plans. Card details are entered on Stripe's own pages and are never seen or stored by us.

Traffic measurement on the public site: Plausible Insights OÜ (Plausible Analytics), for aggregate traffic measurement for the public pages of cybseco.com. It receives nothing about your account, your organisation or your code, and is not used on the signed-in application. Section 3 states exactly what it receives and what it does with it.

Each acts under a written agreement and only on our instructions, or as an independent controller where the law makes it one for payment data.

If you configure an external LLM provider (OpenAI, Anthropic, Mistral, or a self-hosted model), bounded excerpts of the code being analysed are sent to that provider under your own account and choice. Cybseco sends nothing to any model provider unless you configure one. Some of these providers operate outside the European Economic Area; transfers rely on the European Commission standard contractual clauses or an adequacy decision.

We do not sell data and we do not share it for advertising.

To be precise about what that means: our production infrastructure is in the European Union, and the code, projects and findings you entrust to the platform are stored there. It does not follow that every piece of data leaves the Union untouched. Billing data is handled by Stripe, an integration you configure (a repository host, a chat or a ticketing tool) receives what you ask it to, and a model provider you configure receives the excerpts described above. Those are the exceptions, and they are the whole of them.

You may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest. Where processing rests on consent, you may withdraw it at any time without affecting what was done before.

Most of these you can exercise directly in the product: export your data, purge a project, or delete your account.

For anything else, write to contact@cybseco.com. We answer within one month.

If you believe your rights are not respected you may lodge a complaint with a supervisory authority. Ours is the CNIL (Commission Nationale de l'Informatique et des Libertés), France; you may also complain to the authority of your own country of residence.

The controller is 2M IT, 35 rue de Colmar Fort Boulanger, 59170 Croix, France, the company that publishes and operates Cybseco. Cybseco is the name of the service, not of the controller.

See the Legal Notice for full identification.