Privacy Policy

• The website: this marketing and pricing site, including the contact form on the pricing page and the installation booking form
• The scanner: the netvuln-tool software (Apache-2.0 core) you install and run on your own infrastructure
• The collection portal: the optional portal at portal.netvulntool.com/collect where you can upload scan sessions for centralized reporting

Scan output is generated on your systems and stored on your systems. We process uploaded results on your behalf only after you upload them. Information you submit through the contact form is given directly to us.

Outbound Connections and How You Control Them

• CVE enrichment (on by default): sends bare CVE identifiers, and no scan data, to NVD, MITRE, and cvedetails.com to enrich findings; requests carry only the CVE id and the tool's user-agent string; disable with the --no-cve-lookup flag
• Portal upload (off until configured): sends the session results JSON, and optionally the pipeline log and HTML reports, to the portal URL you configured, authenticated with your license key; uploads are capped at 25 MB
• License validation (runs when a portal is configured): the scanner checks your license once per pipeline run; the local cache stores only a SHA-256 fingerprint prefix of the key, never the key itself
• Agent heartbeat (agent mode only): reports its agent id, tool version, schedules, client id, and a system profile covering OS, hostname, hardware (CPU, memory, disk), network interfaces and internal IP addresses, DNS resolver, installed scan-tool versions, scanner configuration, and a public IP address obtained from ifconfig.me; it also probes 1.1.1.1 to test connectivity, and on the Business tier and up, heartbeat responses can carry command-dispatch instructions from the portal
• Alert notifications (off until configured): Slack, webhook, or email destinations you configure receive the target and risk metadata, not the full finding set

The scanner never logs your license key, and its validation cache stores only a SHA-256 fingerprint prefix. The key itself lives in ~/.netvuln/license.key (and optionally your scan configuration) with owner-only file permissions.

License Keys and Share Links

• License keys are stored only as a SHA-256 hash plus a short lookup prefix and compared with timing-safe checks; the full key is shown once at creation and cannot be retrieved afterward
• Report share links use unguessable 64-character random tokens and are served with no-store caching

The scanner reaches a small set of public endpoints; each can be turned off:

• NVD, MITRE, and cvedetails.com receive bare CVE identifiers only, never scan data (CVE enrichment is on by default; disable with --no-cve-lookup)
• ifconfig.me (public IP lookup) and 1.1.1.1 (connectivity probe) are reached in agent mode only
• Alert destinations (Slack, webhooks, email) are ones you configure yourself

• The website: contact-form submissions are retained as long as needed to respond to your inquiry and, if you become a customer, to support your account; you can ask us to delete your submission at any time
• The scanner: results live on your systems and you control retention entirely; completed scan results are never deleted automatically (only temporary working files are cleaned up at the end of a run)
• The portal: session data and uploaded reports are retained until deletion is requested or performed; deletion is a deliberate two-step action (archive, then delete) that removes the database records and the stored files, and portal audit events have a 90-day retention target after which older events are pruned

Uploaded reports are not deleted automatically. The 30-day report validity shown in the portal is a freshness indicator, not a deletion mechanism.

You may:

• Request access to the information we hold about you
• Request correction or deletion of that information
• Ask what we have done with a contact-form submission
• Request deletion of any session your organization uploaded to the portal

Portal tenant scoping means users only ever see sessions for their own organization, and every outbound scanner connection is a configuration choice you can turn off.

Because this website sets no cookies and its analytics are cookieless and aggregate-only, there is no consent banner to manage.

• The website: served only over HTTPS with HTTP Strict Transport Security, a strict Content Security Policy, X-Frame-Options, X-Content-Type-Options, a Referrer-Policy, and a Permissions-Policy; no payment or credential data is collected on this site
• The scanner: the scan pipeline applies owner-only permissions (modes 700 and 600) to the session directories and files it manages; the scanner never logs your license key, and its validation cache stores only a SHA-256 fingerprint prefix
• The portal: all transport uses HTTPS/TLS, including the database connection; license keys are stored as SHA-256 hashes and compared timing-safely; share tokens are unguessable and served with no-store caching; access is role-scoped per tenant

Stored data resides on Netlify and Neon infrastructure and relies on those providers' platform encryption.

This site and its services are directed at businesses, not children under 13, and we do not knowingly collect information from children. If you believe a child has submitted information, contact us and we will delete it promptly.

We may update this policy from time to time. Changes are posted on this page with an updated revision date. Please review it periodically.