Privacy Policy

This Privacy Policy explains how Secdit ("we", "us", or "our") collects, uses, shares, and retains personal data when you visit our website or use our services, including the ConfigSentry firewall auditing platform.

1. Scope

This policy applies to our public website, ConfigSentry sign-up and account flows, cookie preferences tool, support channels, and audit, reporting, and billing features where available.

By using our website or services, you acknowledge the practices described in this Privacy Policy.

2. Data Controller and Contact

If you have questions about this Privacy Policy or how your data is handled, please contact us using the details above.

For account, billing, website, support, and security data, Secdit acts as controller. When an organisation submits configuration content containing personal data for analysis, Secdit may process that content on the organisation's behalf; organisations that require contractual processor terms should contact us before submitting production data.

3. Personal Data We Collect

3.1 Account and Contact Data

When you create an account, sign in, contact us, or manage a subscription or purchase, we may collect:

• Name
• Email address
• Account login information and authentication data
• Account or profile information such as company or organisation name, preferences, and settings
• Billing, purchase, and transaction information where relevant
• User support and correspondence records

3.2 Service and Audit Data

When you use ConfigSentry, we may process data that you submit or that is generated while delivering the service, including:

• Raw firewall configuration data uploaded or retrieved for analysis, including temporary protected processing data where an audit cannot be processed immediately
• Audit findings, scores, reports, and related metadata
• Identified potential security issues and related review notes
• Collector metadata and appliance connection details you configure, while locally-entered secrets can remain on the collector host
• Support requests and correspondence

For the normal hosted audit path, sensitive secret material such as passwords, private certificates, and keys is removed or minimised before temporary processing. Temporary processing data is protected, normally short-lived, and removed after processing. If a manual audit is run with the "Do not save results on website" option selected, the relevant configuration is processed without persistent hosted configuration storage. Audit results, scores, report metadata, and identified potential security issues may still be retained as part of audit history or related account records unless the no-save workflow is used. Those outputs can contain sensitive security-related information about your environment. You are responsible for deciding what you submit and for redacting data where appropriate before upload.

ConfigSentry is currently being offered as an early free trial. A self-service Data Processing Agreement is not currently available. Firewall configuration files can contain sensitive operational information and may contain personal data depending on how an environment is configured. Please only upload configuration files that you are authorised to submit. For early testing, we recommend starting with a lab, test, sample, or sanitised FortiGate configuration where possible. If your organisation requires a Data Processing Agreement, supplier security review, subprocessor details, or specific data-handling terms before uploading production firewall configurations, contact Secdit before using the service.

3.3 Technical and Usage Data

When you visit our website or use our services, our systems may automatically collect:

• IP address
• Browser type and version
• Operating system and device information
• Request timestamps
• Pages viewed and basic navigation data
• Error logs and security logs

3.4 Cookie and Session Data

We use a small number of browser cookies that are necessary for the site to work properly. These are described in our Cookie Policy.

4. How We Use Personal Data

We use personal data to:

• Create and manage accounts and logins
• Provide and operate our website and services
• Run audits and generate reports
• Process billing and purchases where applicable
• Respond to support requests
• Protect the security and integrity of our systems, including fraud prevention and service operation
• Maintain records and comply with legal obligations

5. Legal Bases

Where GDPR applies, we rely on one or more of the following legal bases:

• Contract: to provide the service you request and manage your account
• Legitimate interests: to secure, maintain, and improve our website and services, and to prevent misuse
• Legal obligation: to comply with laws, tax, accounting, and regulatory requirements
• Consent: where required for optional cookies or optional communications

6. Sharing of Data

We do not sell personal data.

We may share data with service providers and advisers only where reasonably necessary to operate our business. Current service providers include Hetzner for hosting in Nuremberg, Germany; Stripe for hosted payment checkout and payment processing; and Cloudflare Turnstile for registration-abuse prevention. Email delivery providers may process transactional or support messages. We may also disclose data where required by law or to protect our rights, users, or systems.

7. Retention

Saved audit records follow the account's selected retention setting: 30, 90, 180, or 365 days, with 365 days as the default; an account administrator may instead select indefinite retention. Expired saved audits are purged by the service. For the normal hosted audit path, secret material is removed or minimised before temporary protected processing, which is generally completed and removed within minutes. If a manual audit uses the “Do not save results on website” option, the relevant configuration is processed without persistent hosted configuration storage.

Deleting audits, reports, or related account data removes them from the live database. Account deletion immediately disables access and is scheduled for permanent deletion after 30 days. Periodic protected backups may retain deleted data for up to 30 days. We may retain limited payment, accounting, security, or dispute records where required or justified by law.

8. Security

We use reasonable technical and organisational measures to protect personal data. No system is completely secure, and we cannot guarantee absolute security.

Public web traffic uses HTTPS with TLS 1.2. Internal database connections are also encrypted with TLS and certificate authentication. Account passwords are stored as password hashes; appliance credentials that the service stores are encrypted and are used only to perform the requested collection. Exported report encryption or password protection, where offered, applies to the downloaded report package and should not be read as a statement about every platform-side storage control. If your review requires more implementation detail, contact Secdit directly.

9. International Transfers

Where personal data is transferred outside the European Economic Area, we use appropriate safeguards where required by law.

10. Your Rights

Depending on applicable law, you may have rights to access, correct, erase, restrict or object to processing, and receive portable data. You may also complain to the Irish Data Protection Commission. To exercise rights, contact us at support@secdit.com or use our contact page. We do not use personal data for solely automated decisions with legal or similarly significant effects.

11. Children

Our website and services are not intended for children, and we do not knowingly collect personal data from children.

12. Changes to This Policy

We may update this policy from time to time. The updated version will be posted on this page when changes are made.

13. Contact

If you have questions about this Privacy Policy or wish to exercise your data protection rights, contact us at support@secdit.com or through our contact page.

Contact Secdit