Privacy notice

Who we are

Attack Surface Scanner by Braintruder is run by Assertive Infosec Solutions Limited, a company registered in England and Wales (company number 16983517). We are the data controller for the personal data described here.

For anything about privacy or your data, email info@assertivesolutions.io. This notice covers the scanner at this address; our company website has its own privacy policy.

What we collect from you

• Account details: your name and work email address. You sign in with a link we email you, or with Google or GitHub if that option is offered and you choose it (we then receive your name and email from them). When you sign up we look up your email domain’s public DNS records to check it can receive email and isn’t a free, disposable or shared-hosting address.
• Your domains and scans: the domains you add, the scans you run and their results, and any share links you create.
• How you found us: campaign tags (utm_source, utm_medium, utm_campaign), the referring site and the first page you visited, kept in a first-party cookie only if you accept it, and saved with your account when you sign up (see Cookies).
• Your choices: whether you ticked the newsletter box (with the date and the wording you saw), and whether you asked us not to contact you about your results.
• Security records: sign-in sessions (IP address and browser), an activity log of actions such as adding or verifying a domain, starting a scan and sharing a report, and rate-limit counters.
• Advert clicks: clicks on Braintruder adverts in the app (which advert, where, and when). Advert views are only counted in total per day, not per person.
• Server and firewall logs: for every request, the IP address, time, address requested and browser. When our web application firewall blocks or flags a request, it also logs that request’s headers and body, which can include what you typed into a form (such as your email address).

Data about people who aren’t users

• Scan results describe organisations’ systems, not people. They can include contact addresses that a domain publishes in public DNS or security.txt (for example a DMARC reporting address). We show these in the report of the user who scanned the domain, delete them with the scan, and never use them for marketing.
• Opt-out requests on the scanner page: the domain, your email address and any message, emailed to the person who handles them so they can act on the request and reply.

Why we use it (UK GDPR lawful bases)

• Contract: to run your account and the scans you ask for, and to send you service emails such as sign-in links and “your report is ready”.
• Legitimate interests: keeping the service secure and preventing abuse (security records, logs, rate limits and the deletion record below); handling opt-out requests; and letting Assertive Infosec’s sales team contact you about the results of scans you asked for. We tell you about the sales contact when you sign up, and you can stop it at any time (see Your rights).
• Consent: newsletters and general marketing, only if you tick the separate, unticked box, and the attribution cookie, only if you accept it. You can withdraw consent at any time: the newsletter on your account page or with the unsubscribe link in any marketing email, the cookie under Cookies below.

We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects. The sign-up email check is a fixed rule (work addresses only); if it refuses an address you think is valid, email us.

Who we share it with

We don’t sell your data. We use these processors:

Vulnerability and end-of-life feeds (NVD, CISA, FIRST, endoflife.date, Retire.js) are downloaded without sending any of your data. We may also disclose data where the law requires it, or to protect our systems and other people from abuse of the scanner.

How long we keep it

• Account details, domains, activity log and advert clicks: until you delete your account.
• Scans and findings: 180 days; raw scanner output: 30 days.
• Sign-in sessions: they expire 14 days after you last use them.
• Server and firewall logs: overwritten as they fill (a fixed amount per service), so normally a few weeks at most.
• Database backups: 35 days.
• Opt-out requests: the email for as long as we need it to handle the request; the domain stays on our do-not-scan list until its owner asks us to remove it.
• When you delete your account we delete your personal data straight away, except a one-way hash of your email address and the number of domain slots you had used. We keep that permanently, so the address can’t be used to register again and reset the free allowance. Copies in backups age out within 35 days.
• Sales contact: emails between you and Assertive Infosec’s team are kept under our company privacy policy.
• The attribution cookie expires after 30 days if you don’t sign up; your cookie choice is remembered for 180 days, then we ask again.

Your rights

• Access and portability: download your data any time from your account page, or ask us for a copy.
• Erasure: delete your account yourself from your account page. Deletion is permanent, and the same email address can’t sign up again.
• Objection to sales contact: tick “Don’t contact me about my results” on your account page, or email us. From then on our sales team no longer sees your account or hears about your scans.
• Rectification, restriction and objection to other processing based on legitimate interests: email us.
• Withdrawing consent to the newsletter: untick the box on your account page or use the unsubscribe link. To the attribution cookie: reject it under Cookies below.

Complaints: please tell us first at info@assertivesolutions.io. We acknowledge complaints within 30 days and reply as soon as we can. You can also complain to the Information Commissioner’s Office at ico.org.uk.

Changes

We’ll update the date at the top when this notice changes, and email registered users about significant changes.