Short version: We collect only what we need to run the service. Some scan data
is processed by the third-party providers listed below, which may be outside the UK. We do not sell your data. You can request deletion at any time.
Who We Are?
CodeCrypse IT Solutions LTD ("VeilScan", "we", "us") is the data controller
for personal data collected through veilscan.net. We are registered with the Information
Commissioner's Office (ICO) in the United Kingdom.
Contact: hello@veilscan.net
What Data We Collect?
2.1 Account data
- Work email address (required for authentication and report delivery)
- Company name (required for reports and invoices)
- Subscription plan and billing status
- Rules of Engagement signature: name, date, domains covered
2.2 Scan data
- Domain names and IP addresses you submit as scan targets
- Scan results: open ports, vulnerabilities, misconfigurations, subdomains
- Generated PDF reports
- Scan history and timestamps
2.3 Technical data
- API access logs (IP address, timestamp, endpoint, response code)
- Session tokens (stored as HttpOnly cookies, not transmitted to third parties)
- Error logs for debugging (anonymised where possible)
2.4 What we do NOT collect
- Passwords — we use email-verified sessions only
- Payment card details — processed directly by our payment provider
- Browser fingerprints, tracking pixels, or advertising identifiers
- Data from authenticated or internal scans (all scans are external only)
What about legal Basis for Processing?
- Contract performance — account data and scan data are necessary to deliver the Service
- Legitimate interests — access logs for security monitoring and abuse prevention
- Legal obligation — records retention as required by UK law
How We Use Your Data?
- Authenticate your account and maintain your session
- Execute scans against your authorised targets and deliver reports
- Send scan notifications, reports, and invoices to your registered email
- Provide Slack alerts for critical findings (if configured by you)
- Detect and prevent abuse, fraud, and Terms of Service violations
- Improve the Service using aggregated, anonymised usage statistics
We do not use your data for advertising, profiling, or sale to third parties.
What about data Storage and Transfers?
Customer data, including scan results, reports, and account records, is stored on infrastructure operated by VeilScan.
Some finding details are sent to third-party AI model providers to help write reports, and scan targets are looked up in
public internet data sources. These providers may process data outside the UK and the EU.
Session and authentication data is stored in an encrypted PostgreSQL database.
What about third-Party Processors?
We use the following sub-processors:
- AWS (Amazon Web Services): cloud infrastructure and S3 storage.
- AI model providers: finding details, such as the affected host and a description of the finding, are sent to the AI model provider configured for the service to help write impact explanations and reports. Supported providers are Anthropic, Groq, OpenRouter, NVIDIA and Google (Gemini). These providers may process data outside the UK and the EU.
- Public internet data sources: scanned domains and IP addresses are looked up in Shodan InternetDB, ipinfo.io, RIPEstat and the Internet Archive Wayback Machine.
- Dodo Payments — payment processing. Card data is processed directly by the provider and is not transmitted to us.
- Resend — transactional email (report delivery, scan notifications). Only your email address and the email content are shared.
We do not use third-party analytics, advertising networks, or social media tracking pixels.
What about data Retention?
- Active account: data retained for the lifetime of the subscription
- Cancelled account: scan data and reports retained for 30 days, then permanently deleted
- Deletion request: processed within 30 days; see Section 8
- Invoices and billing records: retained for 7 years as required by UK financial regulations
What about your Rights (UK GDPR)?
You have the following rights regarding your personal data:
- Access — request a copy of all personal data we hold about you
- Rectification — request correction of inaccurate data
- Erasure — request deletion of your data ("right to be forgotten")
- Restriction — request we limit processing in certain circumstances
- Portability — receive your data in a machine-readable format
- Objection — object to processing based on legitimate interests
To exercise any right, email hello@veilscan.net with the
subject line "Data Rights Request". We will respond within 30 days. We may need to verify your
identity before fulfilling the request.
You also have the right to lodge a complaint with the ICO:
ico.org.uk | 0303 123 1113.
What about cookies?
We use one strictly necessary cookie: vs_session, an HttpOnly, Secure, SameSite=Lax
session token used exclusively for authentication. We do not use analytics cookies,
advertising cookies, or any third-party tracking cookies.
We also use a short-lived vs_flash cookie for displaying one-time UI notifications.
It contains no personal data and expires after a single page load.
What about security?
We implement appropriate technical and organisational measures to protect your data, including:
encryption at rest (AES-256), encryption in transit (TLS 1.2+), access control with least
privilege, and regular security reviews. For details, see our
Security page.
What about changes to This Policy?
Material changes to this Privacy Policy will be communicated to your registered email address
at least 14 days before they take effect. The current effective date is always shown at the top.
What about contact?
Privacy questions and rights requests:
hello@veilscan.net
CodeCrypse IT Solutions LTD, England & Wales