securityscanner.org

Privacy notice

One line: the scanner keeps your first name, email address, domain, two sign-up answers and the scan results while you are signed up and for 30 days after; the record that you authorised the scan, and a minimal scan log, are kept for 13 months; it uses them only to send you reports and to prove the scan was asked for; it never sells or shares the list; nothing else is tracked.

Last updated 30 October 2026. The controller of this data is Human Compute LLC, Winston-Salem, North Carolina, United States. Questions: abuse@securityscanner.org.

What is collected

Your first name
Given by you at sign-up. Used to address the emails.
Your email address
Given by you at sign-up. Used to send the confirmation link, the reports, and occasional short notices about the service itself.
Your domain
The website you asked to have scanned. Used to run the scans and to match abuse complaints to an authorised sign-up.
Two answers from the sign-up form
Whether customers or prospects ask you for a SOC 2 report or a security questionnaire, and what kind of business it is (software, agency, other). If you answered yes, I may write to you once, personally, about the paid SOC 2 readiness work. That is the only use. Neither answer changes the scan.
The consent record
The time the confirmation link was clicked and the IP address it was clicked from, and, for the verified level, the DNS TXT record or .well-known file, its value, and when it was looked up and seen. Kept for 13 months, and kept in a form that cannot be edited, so that any complaint about a scan can be answered with evidence that the owner asked for it.
Scan results
The findings and grades for each scan, so each report can show what changed since the last one. Results describe the public face of the website. They are not published and not shared.
A minimal scan log
For each request the scanner made: the time, the scanner's own address, the target address and host, the path or port asked for, the response code and the scan token. No page contents. Kept for 13 months so a complaint about last month's scan can be matched to what actually happened.
Email delivery records
Whether each email was delivered, bounced or marked as spam, so that dead addresses are removed. Whether you opened or clicked is not tracked, except the unsubscribe link and the confirmation link, which have to be recorded to work. There are no tracking pixels.

What is not collected

This website sets no cookies and runs no analytics or advertising scripts. No third party collects personal information about you across websites from this site. The only third-party request a page makes is for the fonts, served by Google Fonts, which receives your IP address as any font download would. The sign-up form sends what you typed to the scanner's own back end and nowhere else. Web server logs, which include IP addresses, are kept for 30 days for security and to count visits, then deleted. If reports later move behind a login reached from the email, that login will need a session cookie, and this notice will say so first.

What it is used for

  • Running the scans you asked for and sending you the reports.
  • Proving, if anyone asks, that the scan of a domain was authorised.
  • Keeping the service running: removing bounced addresses, stopping abuse, fixing bugs.
  • The one paragraph at the bottom of each report about the paid work I do, and one personal note if you said customers ask you for SOC 2. That is the only marketing, and it is in the email you asked for.

Who sees it

Nobody outside Human Compute LLC, with one exception: if a domain's owner or host complains about a scan, they are shown the evidence that it was authorised, which is the email domain that confirmed (not the full address), or the verification record, with timestamps. Addresses and scan results are never sold, rented, swapped, shared or given to anyone. Reports go only to the verified address signed up for that domain and are never published. Sponsors, if there are ever any, see aggregate counts only, such as how many people are on the list. They get no addresses, no domains, no per-recipient links and no pixels. The data is stored in Amazon Web Services in the United States, which processes it on my behalf under its standard terms. If a law or court order requires disclosure, only what is required is disclosed, and you are told unless the law forbids it.

How long it is kept

Two different clocks, said plainly.

  • Your personal data: 30 days after you leave. Your name, email address, the two sign-up answers and the scan results are kept while the domain is signed up, plus 30 days after you unsubscribe or the sign-up is closed, to handle late complaints and any "I did not mean to leave" requests. Then they are deleted. Unconfirmed sign-ups (link never clicked) are deleted after 7 days.
  • The consent record and the minimal scan log: 13 months. The record that the scan was authorised (the confirmation click or the DNS lookup, with timestamps and IP address) and the per-request scan log are kept for 13 months from each scan, whether or not you are still signed up. They are the proof that the scanner only touched your site because you asked, and 13 months covers a complaint about any scan in the past year. Then they are deleted.
  • Abuse correspondence is kept for one year. Web server logs for 30 days.

Your choices and rights

  • Unsubscribe with the link in any email. That stops the scans as well as the email. Removing the DNS record or the file, setting the record to securityscanner-verify=deny, or writing to the address above also stops the scanner.
  • Ask for a copy of what is held about you or your domain, a correction, or deletion of your personal data sooner than the 30 days, by writing to the address above. Replies come within 30 days. The consent record and scan log stay for their 13 months, because they are the record that the scan was lawful.
  • Residents of California and other US states with privacy laws have the rights those laws give them, and they are honoured for everyone, not only where required. Nothing is sold, so there is nothing to opt out of selling.

Security

Data is stored encrypted, access is limited to me, and the service itself is checked with the same scanner and with the same internal reviews I do for clients. If a breach ever affects your data, you are told by email without undue delay.

Children

The service is for businesses and is not directed at anyone under 18.

Changes

If this notice changes in a way that matters, the next monthly email says so and the date at the top moves.

Contact

Human Compute LLC, 1331 Murphy Ln, Winston-Salem, NC 27104, United States. abuse@securityscanner.org. Phone +1 336 777 7237.