In one page
- What we read
- Public records about a firm: DNS, certificates, registration records, its own public pages and breach data about addresses at its own domain.
- What we never do
- Sign in to a firm's systems, type into its forms or go inside its email.
- Where it lives
- Railway in the United States. Encrypted backups at Cloudflare and GitHub.
- In transit
- HTTPS, with HSTS.
- Backups
- Daily, AES-256-GCM, the key kept apart from our code.
- Who sees a record
- Our staff with a second step. A person signed in to that record by its emailed code.
- Customer secrecy
- We never say who our customers are.
- Vendors
- Listed with what each receives. Our code cannot send data to a host off that list.
- Incident notice
- Within 72 hours of learning that a breach involves the customer's information.
- Deletion
- On request, confirmed in writing within 30 days.
How long each record is kept
- A paid assessment's readings
- The life of the engagement and seven years after.
- A reading no record points at
- Deleted by the weekly clean-up once three days old.
- Visits to a reading
- Kept with the reading until the firm asks us to delete them.
- Sign-in codes and tries
- Deleted seven days after they are made.
- Inside checklist notes
- Cleared after twelve months. Answers and dates stay.
- Unsubscribes and the do-not-assess list
- Kept so each one keeps working.
- Purchase records
- At least six years after the tax year they relate to.
- The evidence record
- Fifteen years from each entry.
- Backups
- Cloudflare the most recent 72 days, GitHub the most recent 14.
- Licensed data
- De-identified first. Nothing in it says who our customers are.
Contact
LeakTrace Inc., 1200 Bay Street, Suite 1201, Toronto, ON M5R 2A5, Canada. Email [email protected].