Privacy policy

What we collect

• Account data: name, email, organization name, role.
• Asset data: hostnames you register, verification and authorization records (including signer name and IP address).
• Scan data: technical observations such as certificate details, response headers and public DNS records. Cookie values and authorization headers are redacted before storage.
• Billing data is processed by Stripe; we do not store card numbers.

How we use it

To provide the service, produce reports, send alerts you've configured, and improve accuracy. We do not sell personal data.

AI processing

To draft reports we send minimized, structured scan findings (no cookies, page content or credentials) to an AI provider under terms that prohibit training on your data. A human reviews serious findings before publication.

Retention

Raw scan evidence is retained for 90 days; findings and reports for the life of your account. Deleting your organization permanently removes its data from our primary database; backups roll off within 30 days.

Your rights

You can export your data (JSON) and delete your organization from Settings. Contact privacy@plainshieldsecurity.com for other requests.

Security

Data is encrypted in transit; access is limited by role and logged. Customer data is isolated per organization.