Privacy Policy

1. Introduction

Welcome to Secuarden. Secuarden is a product security intelligence platform that transforms security tool outputs into compliance evidence that auditors trust. We are committed to protecting your privacy and handling your data with transparency and care.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, including our web application, services, and integrations (collectively, the "Service"). Please read this policy carefully.

2. Information We Collect

2.1 Information You Provide

• Account Information: When you create an account, we collect your github username and email address in order to provide you with personalized security insights and compliance reports.
• GitHub Integration Data: When you connect your GitHub account, we receive your GitHub username, avatar, and access tokens to repositories you authorize.
• Payment Information: If you purchase credits or upgrade your plan, we collect billing information through our secure payment processor. We do not store or process credit card numbers.
• Feedback and Communications: Any feedback, bug reports, or support requests you submit through our platform.

2.2 Information We Collect Automatically

• Repository Data: When you authorize repository access, we collect metadata including repository names, structures, file paths, commit histories, and code content for security analysis.
• Security Scan Results: Findings from security tools, vulnerability data, and our Context Confidence Rating (CCR™) analysis.
• Usage Data: Information about how you interact with our Service, including features used, pages viewed, scan frequency, and timestamps.
• Technical Data: IP addresses, browser type, device information, operating system, and referring URLs.
• Log Data: Server logs, error reports, and performance metrics.

2.3 Information from Third Parties

• GitHub: We receive repository access permissions, webhook events, and security alerts based on the permissions you grant.

3. How We Use Your Information

We use the collected information for the following purposes:

• Service Delivery: To provide security scanning, context analysis, CCR™ scoring, and compliance reporting.
• Analysis and Intelligence: To generate contextual security insights, detect compliance obligations, and create audit-ready reports.
• Platform Improvement: To enhance our AI models, improve detection accuracy, and develop new features.
• Account Management: To manage your account, process payments, and provide customer support.
• Communication: To send service updates, security alerts, feature announcements, and respond to inquiries.
• Security and Fraud Prevention: To detect, prevent, and address security issues, fraudulent activity, and abuse.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, and enforceable governmental requests.
• Analytics: To understand usage patterns, measure performance, and improve user experience.

4. Data Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

4.1 With Your Consent

We share information when you explicitly authorize us to do so.

4.2 Service Providers

We work with third-party service providers who assist us in operating our platform:

• Infrastructure: Cloud hosting and database providers
• Payment Processing: Secure payment processors for billing operations
• Security Tools: Integration with security scanning tools (Semgrep, Trivy, CodeQL)

These providers are contractually obligated to protect your data and use it only for the services they provide to us.

4.3 Legal Requirements

We may disclose information if required by law, legal process, or government request, or if we believe disclosure is necessary to:

• Comply with legal obligations
• Protect and defend our rights or property
• Prevent fraud or security issues
• Protect the safety of users or the public

4.4 Business Transfers

If Secuarden is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

4.5 Aggregated and De-Identified Data

We may share aggregated, de-identified, or anonymized data that cannot reasonably be used to identify you.

5. Data Security

We implement industry-standard security measures to protect your information:

• Encryption: Data in transit is encrypted using TLS/SSL. Sensitive data at rest is encrypted.
• Access Controls: Strict access controls and authentication mechanisms limit who can access your data.
• Regular Audits: We conduct security audits and vulnerability assessments regularly.
• Secure Infrastructure: Our infrastructure follows security best practices and compliance standards.
• Employee Training: Our team is trained on data protection and security practices.

6. Data Retention

We retain your information for as long as necessary to provide our services and fulfill the purposes described in this policy:

• Account Data: Retained while your account is active and for a reasonable period after account closure for legal and operational purposes.
• Repository Data: Retained as long as you maintain the integration. You can disconnect repositories at any time.
• Scan Results: Historical scan results are retained to provide trend analysis and compliance history. You can request deletion of specific scan data.
• Log Data: Typically retained for 90 days for security and debugging purposes.

When data is no longer needed, we securely delete or anonymize it.

7. Your Rights and Choices

Depending on your location, you may have the following rights:

7.1 Access and Portability

You can request a copy of your personal information and, where applicable, receive it in a structured, commonly used format.

7.2 Correction

You can update or correct your account information through your account settings or by contacting us.

7.3 Deletion

You can request deletion of your personal information. Note that some information may be retained for legal or operational purposes.

7.4 Opt-Out

• Marketing Communications: You can unsubscribe from marketing emails using the link in any message.
• Analytics: You can opt out of certain analytics tracking through your browser settings or by contacting us.

7.5 Restrict Processing

You can request that we limit how we use your information in certain circumstances.

7.6 Data Portability

You can export your scan reports and findings data from your dashboard at any time.

To exercise any of these rights, please contact us at privacy@secuarden.com. We will respond to your request within 30 days.

8. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience:

8.1 Types of Cookies We Use

• Essential Cookies: Required for authentication, security, and basic platform functionality.
• Preference Cookies: Remember your settings and preferences.

9. Third-Party Services and Links

Our Service integrates with third-party services:

• GitHub: Subject to GitHub's Privacy Policy

We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

10. Children's Privacy

Secuarden is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child, we will take steps to delete that information promptly.

If you believe we have collected information from a child, please contact us immediately at privacy@secuarden.com.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from your jurisdiction.

When we transfer data internationally, we implement appropriate safeguards to protect your information, including:

• Standard contractual clauses approved by regulatory authorities
• Data processing agreements with service providers
• Compliance with applicable data protection frameworks

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

• Posting the updated policy on this page with a new "Last Updated" date
• Sending an email notification to your registered email address
• Displaying a prominent notice in the application

Your continued use of the Service after changes become effective constitutes acceptance of the updated policy. We encourage you to review this policy periodically.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: