Privacy Policy

This explains what SecureSimple collects, why, who else sees it, and what you can ask us to do about it. We do not track you, sell your data or show advertising.

1. What we collect

Your login. Your email address, your password stored only as a hash, when you signed up and last signed in, and which version of our Terms of Service and this policy you accepted, when, and from which IP address.

Your accounts. Each account's name, its members and their roles, and the email addresses of people you invite.

What you watch. Your environments, the products you list in them, any versions you enter, which environments you follow, and whether you want alert emails.

Payment. If you subscribe, Stripe collects your name, billing address and card details. We keep only Stripe's reference for you, your plan, and when it renews or ends.

Messages. What you send us through the contact form, with the name and email address you give, the IP address it came from, when it was sent, and your login if you were signed in.

Technical. IP addresses and the pages requested, in normal web server logs, and to limit repeated attempts to sign in.

2. The list of what you run is sensitive, and we treat it that way

A list of the software an organization runs, and which versions, could help someone attack it. Yours is never shared, sold or published, never used in statistics or examples, and never sent to the AI service described below. Only the members of your account can see it.

3. What we never collect

Access to your systems. We never connect to them. We know only what you tell us.

Your card details. They go straight to Stripe and never reach our servers.

4. Why we hold it

To run the service you asked for: matching vulnerabilities to your products, showing you the results and emailing you about them. To take payment for paid plans. To contact you about your login or account. To keep the service secure and working.

5. Who else sees it

We use a small number of providers, and each sees only what it needs to:

• Stripe processes payments and holds your billing details.
• Amazon Web Services delivers our email, so it handles your email address and what our emails to you say, including the product names in an alert.
• Google reCAPTCHA checks that the sign-up and contact forms are sent by a person. On those two pages Google sees your IP address and how you use the page.
• Anthropic writes the plain-language summaries of vulnerabilities. We send it only the public vulnerability record, never anything about you, your account or what you run.

We may also disclose data where the law requires it. Otherwise we share it with no one.

6. Addresses that attack this site

The home page lists IP addresses our intrusion prevention system blocked for probing or attacking our servers, with the country and network they came from. They are kept and shown to protect this site and to warn others about them.

7. How long we keep it

Your data stays while you have a login. Closing an account deletes its environments and everything in them. Deleting your login deletes what we hold about you, including your consent records, along with any account of yours that has nobody else in it. That is permanent.

Messages you send us are kept so we can follow up on them. Those sent while signed in are deleted with your login; you can ask us to delete any other message.

Web server logs are kept for 31 days. Stripe keeps its own payment records for as long as the law requires it to.

8. Your rights

Wherever you live, you can ask us to:

• tell you what we hold about you;
• give you a copy of it;
• correct anything that is wrong;
• delete your login and your data.

Depending on where you live you may have further rights, including under the GDPR or California law. We apply the list above to everyone, whatever their location. Contact us and we will act on requests promptly.

9. Email

We email you to confirm your address, to reset your password, about invitations, and with the alerts you asked for. Every alert email has a link that turns alerts off without signing in. We do not send marketing email.

10. Cookies

We use only the cookies the site needs to work: to keep you signed in, to remember which account you are looking at, and to protect forms. See the Cookie Policy for the full list.

11. Security

The site is served over HTTPS. Passwords are stored as hashes, never in readable form. The codes in invitation and unsubscribe links are stored only as hashes or derived from secrets we keep, so a copy of our database would not let anyone use them.

12. Children

SecureSimple is not intended for anyone under 18, and we do not knowingly collect data from children.

13. Changes

We may update this policy. Each version has a version number and an effective date at the top of this page, and we record which version you accepted. We will tell you about a significant change instead of making it quietly.

14. Contact

For any privacy question or request: contact us.