Privacy Policy

HyperSec (“we”) provides HyperSec. For the personal data described here we act as the controller of your account and billing data and as a processor of the scan data you submit on behalf of your organization.

Contact for privacy questions and requests: [email protected].

• Account data. Name, email address and sign-in details, handled by our identity provider (Clerk). We store an identifier for you, your organization memberships and your role.
• Organization and team data. Organization name, members and their roles, invitations (the invited email address), API key names and a hash of each key, webhook endpoints, and an audit log of administrative actions.
• Application and scan data. The URLs and domains you add, verification records, scan settings and schedules, security grades, findings and the evidence behind them. Evidence is made of the requests and responses our agents exchanged with the target, so it can contain whatever those pages return, including personal data of the target’s users and technical secrets.
• Credentials you provide for authenticated testing. Usernames, passwords or one-time codes you enter so the agents can sign in to your application. See “Testing credentials” below.
• GitHub data. If you install the GitHub App: installation and repository identifiers, pull request metadata and diffs for the reviews you enable.
• Billing data. Plan, subscription status, credit balance and a record of each charge, refund and dispute (amounts, tax, dates, Stripe references and the billing email). Card details are collected by Stripe; we never receive the card number.
• Communications. Messages you send through the contact form (name, email, company, website, message and IP address) and a log of the transactional emails we send you.
• Technical and usage data. IP address, browser, request logs, error reports, and metering of API and MCP calls per organization.
• Free surface scans. The hostname you scan and its public result. These results are kept for 24 hours and shown to whoever has the result link.

• To provide the Service (contract): run scans, store and show findings, send notifications, operate the API and MCP server, process payments and enforce plan limits.
• To keep it secure and prevent abuse (legitimate interests): authentication, rate limiting, verification of domain ownership, detecting misuse of the free plan, audit logging and incident response.
• To improve and support the Service (legitimate interests): diagnose errors, measure reliability and capacity, answer your messages.
• To meet legal obligations: accounting, tax and responding to lawful requests.
• With your consent, where we ask for it, for example optional cookies.

The security agents are large language models. To do their work, the content of your scan (target URLs, captured requests and responses, findings and evidence, and for PR review the code diff) is sent to our model provider, Google, through our own gateway, which also applies per-organization budgets.

We do not sell your data and we do not use it to train third-party models. Do not submit data you are not allowed to share with these providers. See Subprocessors.

Credentials you give us for authenticated testing are used to sign in to the application you authorized, during that scan. They are passed to the scan workflow as part of its input and are not stored in our application database. They remain in the scan workflow’s execution record inside our infrastructure until that record is removed under the retention periods below.

Use dedicated test accounts with the least privilege that lets the agents test what you need, never an administrator or personal account, and rotate them afterwards.

We use the service providers listed on our Subprocessors page (identity, payments, email, model inference, hosting, network, GitHub, and two scan helpers). We run the databases, workflow engine, model gateway, browser cluster, traffic-inspection proxy and logging ourselves, on our infrastructure.

We disclose data to authorities only when legally required, to protect the rights or safety of people or the Service, or in a business transfer, in which case the recipient is bound by these commitments. We do not sell personal data.

Our infrastructure is hosted in the European Union and some of our providers process data in other countries, including the United States. Where personal data is transferred out of the EEA or UK, we rely on an adequacy decision, the European Commission’s Standard Contractual Clauses, or another transfer mechanism the law recognises.

• Account and organization data: while your account exists. If you delete your account or organization it is scheduled for removal after a 30-day period during which it can be recovered.
• Scans, findings and evidence: until you delete the application or organization.
• Free surface scan results: 24 hours.
• Billing and transaction records: kept as long as tax and accounting rules require (generally several years), even after account deletion.
• Security and audit logs: a limited period needed for security and troubleshooting.
• Contact-form messages: as long as needed to handle your request, then removed.

• Traffic is encrypted in transit with TLS; organization-level LLM keys are encrypted at rest.
• Every query is scoped to the organization it belongs to, and access is controlled by roles.
• API keys are stored as hashes, scoped and revocable.
• Webhooks from Stripe and GitHub are signature-verified; sensitive actions are written to an audit log.
• Model-written code runs in isolated sandboxes.

Depending on where you live (for example under the GDPR, the UK GDPR or California law) you can ask to access, correct, delete or export your personal data, to object to or restrict some processing, and to withdraw consent. You can delete your account and organizations yourself in Settings.

To exercise a right, email [email protected]. We will answer within one month. If you are not satisfied you may complain to your data-protection authority.

If you are an end user of a HyperSec customer’s application and your data appears in scan evidence, that customer is responsible for it: please contact them, or us and we will pass your request on.

• Sign-in session (Clerk): strictly necessary to keep you signed in.
• Active organization (hypersec_active_org): remembers which organization you are working in.
• Theme (hs_theme): remembers light or dark mode.
• Surface-scan claim (surface_scan_claim): lets you save a free scan result to your account, for 24 hours.
• Cookie choices: stores what you chose in the cookie panel.

We do not use advertising cookies.

HyperSec is a business service and is not directed to anyone under 18. We do not knowingly collect data from children.

We will update this policy when our practices change and show the new date above. For material changes we will tell you by email or in the dashboard before they apply.