Privacy

Who we are

CipherProof (“we”, “us”) runs the website at cipherproof.si and the application at app.cipherproof.si. We decide how and why the personal data described here is used, which makes us the controller of your account data. For the content you put into your projects we act on your behalf; see “Content about your clients” below.

For anything about your data, write to [email protected] and put “Privacy” in the subject.

What we collect and why

We collect only what the service needs to work.

A Free account that has been unused for 12 months may be deleted after we email you at least 30 days before.

What we do not collect

• No analytics, advertising or tracking scripts, on the website or in the app.
• Nothing is loaded from other sites. Fonts and scripts come from our own servers, so no third party learns that you visited.
• We do not sell your data, share it for marketing, or build advertising profiles.

Content about your clients

A pentest report may include names, email addresses, user records or other personal data that belong to other people, such as your client’s staff or customers. For that content, you decide what is entered and why, and we process it only on your instructions to provide the service, as your processor.

• We do not use it for our own purposes, and we do not access it except to give you support you asked for, to keep the service secure, or when the law requires.
• We keep it confidential, and we protect it as described on the Security page.
• We tell you without undue delay if we find a security breach that affects it.
• When you delete it, or your account, we delete it.
• If you need a data processing agreement, or the current list of providers that handle your content, write to us and we will send them.

Please enter only the personal data a report really needs, and cover the rest. The screenshot editor is there for that.

Our legal grounds

Where the law asks for a legal ground, we rely on:

• Contract, to create your account and provide the service you asked for;
• Legitimate interests, to keep the service secure, prevent abuse and improve it, which we balance against your rights;
• Legal obligation, for example tax records of paid plans;
• Consent, only where we ask for it, and you can withdraw it at any time.

Who we share data with

Only your account sees your projects. We do not show one account’s data to another.

We use a small number of providers to run the service: a hosting provider, an email delivery provider and, for paid plans, a payment provider. They process data only to provide those services to us, under written terms that require them to protect it. Their names, and the countries where they store data, are available on request.

We disclose data to a public authority only when the law requires it, and we tell you first unless the law forbids it.

If we are ever sold or reorganised, your data would move with the service under the same promises, and we would tell you beforehand.

Where your data goes

Your data is stored on a server in the European Union, rented from Contabo. The Security page lists every provider that handles data and what each one receives. If a provider handles data outside your country, we make sure the transfer has the safeguards the law requires, such as standard contractual clauses. You can ask us where your data is stored at any time.

Cookies

The website sets no cookies. The app sets two, both strictly necessary, both readable only by the server, not by scripts on the page:

• A session cookie keeps you signed in. It ends after 14 days without use and never lasts longer than 60 days.
• A sign-up cookie lasts up to 48 hours. It lets the confirmation link in your email sign you in when you open it in the same browser you signed up with.

Because they are needed to provide what you asked for, they need no consent. We use no other cookies and no other browser tracking today.

Your choice. The website asks once whether you accept optional cookies. There are none today. If we ever add some, for example to measure our own ads, they load only after you accept them. The answer is kept in your own browser (local storage, under the name cp_consent) and is never sent to us. Change it at any time with Cookie settings in the footer.

How we protect it

Passwords are stored as scrypt hashes. Two-factor sign-in is required on every account. Sessions are kept in cookies scripts cannot read, repeated failed sign-ins are slowed down, a strict content policy stops the app from loading anything from other sites, and uploaded files are checked before they are read. The Security page describes each measure, and says plainly what we do not have yet.

Your rights and choices

Depending on where you live, the law, including the EU General Data Protection Regulation and the data protection law of the country where you live, may give you the right to:

• know what we hold about you, and get a copy;
• correct it, or have it deleted;
• restrict or object to how we use it;
• take it with you in a common format;
• complain to your data protection authority.

Most of this you can do yourself on the account page: export everything in your account as a JSON file, delete your account and every project in it (you confirm with your password and email address), turn on two-factor sign-in, and sign out other sessions. For anything else, write to [email protected]. We answer within 30 days.

Children

CipherProof is a professional tool for adults. It is not meant for anyone under 18, and we do not knowingly collect data from them. If you think a child has given us data, tell us and we will delete it.

Changes to this page

When we change how we handle personal data, we update this page and its date. For a change that matters, we email you at least 30 days before it takes effect.

Contact

Write to [email protected] with “Privacy” in the subject. Security problems go to [email protected].