Privacy Policy

Effective Date: May 7, 2026 · Last updated: November 4, 2026

1. Introduction

Cipherline LLC (“Company”, “we”, “us”, “our”) operates the XploitScan platform. We believe privacy is a right, not a feature. This Privacy Policy explains what data we collect, what we do with it, and what we don’t do with it. We’ve written this in plain language because we think you should actually be able to understand your privacy policy. This Privacy Policy works together with our Terms of Service, which governs your use of the Service.

2. What We Collect

We collect the following types of data:

Account Information: When you sign up, we receive your name, email address, and profile information through Clerk, our authentication provider.
Scan data (signed-in scans): When you run a scan while signed in, we store the scan results: the name of the scanned folder or repository; scan metadata (date and time, grade and score, duration, detected frameworks and AI builder platform, scanner version and AI model); how many files were received, and how many files were skipped and why; findings metadata (severity, rule IDs, file paths, line numbers, written fix guidance, compliance mappings and vulnerability types); code-quality findings; the locations in your README or instruction files that a finding contradicts (not the text itself); and AI review decisions with the model's short reasons when AI filtering runs. For a detected secret, the finding's description shows a masked preview of no more than the first 6 and last 4 characters (with the rest hidden); that description is stored with the finding and in the AI review record. Apart from these masked previews, we do not store your code, code excerpts or suggested code changes. We use this to show your scan history, Trust Pages and trends. Scans run without signing in are not kept unless you sign in from the results page to save them.
API key requests: When you use an API key, our servers receive your IP address and user-agent with each request.
Usage Statistics: We collect general usage data such as how often you use the Service, which features you use, and how you interact with scan results. This helps us improve XploitScan.
Billing Information: If you subscribe to a paid plan, Stripe processes your payment information. We store your subscription plan type, billing interval (monthly or annual), and subscription status in our database. We do not store your credit card number or full payment details on our servers. When you start a free trial, we keep a one-way keyed hash of your email address and of your card's Stripe fingerprint, to stop repeat free trials; it is kept after account deletion and cannot be turned back into your email or card number.
Team Data: If you are a Team plan owner or member, we store team membership information including email addresses of invited members, assigned roles, invitation status, and team association.
Audit Logs: We log account-related actions (such as subscription changes, team invitations, and role modifications) for security and accountability purposes. Audit logs include the user ID, action type, timestamp, and relevant details.
Referral Data: The referral program is available to users with active Pro or Team subscriptions who hold owner or admin roles. If you participate, we store your unique referral code, the user IDs of users you referred, and whether those referrals resulted in paid subscriptions. Referral rewards are applied as Stripe balance credits to your account based on conversions.
Webhook Configuration: If you configure webhook integrations, we store your Slack and/or Discord webhook URLs. Webhook URLs must be valid HTTPS URLs from approved domains (Slack and Discord only).
Notification Preferences: We store your email notification preferences (such as scan completion alerts, trial reminders, and weekly digests) so we can respect your communication choices.
Other Account Data: If you use these features, we also store your security questionnaire answers, your Trust Page content, GitHub App installation and pull-request check records (account and repository names, PR numbers, commit IDs and finding counts), feedback you send us, hashed API keys, domain-verification records, names you give your signed-in devices, and project descriptions you enter.
Error Data: We collect application error reports through Sentry to identify and fix bugs. This may include browser type, operating system, IP address, and the page URL where an error occurred. It does not include your source code or scan content.
Free Trust Page Data: If you create a Free Trust Page at xploitscan.com/free-trust-page (no account required), we store the company name, optional website URL, optional self-attested policy fields (privacy policy URL, security contact email, data retention text, incident response text, subprocessors list), and self-attested compliance flags you choose to publish. We also store the email address you provide so we can send you the confirmation email containing your edit and claim links, and we count how many pages have been created for that address in the past 24 hours to limit how many confirmation emails one address can receive per day. Free Trust Page content is user-generated; we do not verify the accuracy of any field you enter, including company affiliation.
Rate-Limit Fingerprint: When you create a Free Trust Page anonymously we compute a keyed hash (HMAC-SHA-256) of your IP address. We store the truncated hash, not the raw IP, only to enforce the daily creation cap and discourage abuse. The hash is not linked to your identity, and without our secret key it can’t be turned back into your IP address. Signed-in users bypass this hashing entirely.
Claim Session Cookie: When you click a “claim this page” link, we set a short-lived (30-minute) HTTP-only cookie named xs_pending_claim containing the slug and claim token of the page being claimed. The cookie is removed automatically when the claim completes or expires. It is never used for analytics, tracking, or any purpose other than binding the page to your new account.
Demo scan limits: When you scan without signing in, including demo scans and sample-code scans, we store a one-way keyed hash of your IP address (IPv6 addresses are grouped by network before hashing), so we can limit scans of your own code to 3 a day and prevent abuse of sample-code scans. We never store your IP address itself, we use this only to enforce those limits, and we delete it within 48 hours.

3. What We Do NOT Collect

This is just as important as what we do collect:

We do not keep your full source tree. Uploaded files and ZIPs are processed in memory and are not stored. For signed-in scans we keep only the scan results described in Section 2. When AI-powered analysis is enabled, small excerpts (the flagged line and up to 10 lines either side, each line capped at 300 characters), along with the finding's description, are sent to our AI provider (Anthropic) for contextual review and false positive filtering. Before an excerpt and the finding's description are sent, secrets our scanner detects in them are masked to no more than the first 6 and last 4 characters; other code, including any secret the scanner does not detect, is sent as written. On the Free plan, AI review runs on up to 5 scans a day. This is on by default for signed-in users. You can switch it off in Settings; that applies to scans from the Scan page, homepage and demo scanners while you are signed in, and GitHub App pull-request checks. Scans run without signing in are not sent for AI review. The CLI scans on your machine. If you set your own ANTHROPIC_API_KEY, the CLI sends your code to Anthropic directly, under your own Anthropic account, in chunks of whole files, and excerpts around each finding for false-positive filtering. If you sign in to the CLI with an XploitScan API key, it uploads its findings to XploitScan, including the code excerpts and suggested fixes around each finding; our servers remove those excerpts and fixes before saving the results. To keep your code away from Anthropic, scan without signing in, switch AI review off in Settings, or use the CLI without setting ANTHROPIC_API_KEY. See Section 7.
We do not sell your personal information. We do not sell, rent, or share your personal information with third parties for marketing or advertising purposes. This applies to all users, regardless of location.
We do not use your data to train AI models. XploitScan uses AI to filter false positives out of scan findings and to score security-questionnaire answers. We do not use your source code, scan results, or any personal data to train machine learning models or large language models (LLMs).
We do not track you across other websites.
The XploitScan MCP server sends nothing without an API key. Our published Model Context Protocol server (xploitscan-mcp on NPM) runs locally over stdio, as a process your MCP client (Claude Desktop, Cursor, Windsurf, Continue, Cline, Zed) starts on your machine. Without an XPLOITSCAN_API_KEY it makes no network calls and sends no telemetry. If you set an API key, the server sends that key to xploitscan.com to check your plan and download the paid rules, then runs them locally. It never transmits your code outside your machine. The NPM package itself is downloaded once from the public NPM registry the first time you invoke it, then cached locally.
The XploitScan VS Code extension works the same way. Without an API key it makes no network calls. If you enter an API key, the extension sends that key to xploitscan.com to check your plan and download the paid rules, then runs them locally. It never transmits your code outside your machine.

4. How We Use Your Data

We use the data we collect to:

Provide and operate the XploitScan scanning service
Display your scan history, vulnerability trends, and compliance coverage
Process payments and manage your subscription (including plan changes and proration)
Send you important service updates, security notifications, and transactional emails in accordance with your notification preferences
Send occasional product emails, such as feedback surveys and offers, which you can unsubscribe from at any time.
Manage team membership, invitations, and role-based access
Improve the accuracy and performance of our scanning engine
Monitor and fix errors in the Service
Maintain audit logs for security and accountability
Respond to your support requests
Comply with legal obligations

5. Team Data Sharing

If you are part of a team on XploitScan, your scan results (including project names, grades, scores, and finding summaries) may be visible to other members of your team. The team owner controls team membership and can add or remove members. By accepting a team invitation, you consent to sharing your scan data with other team members. If you leave or are removed from a team, your historical scan data will no longer be accessible to that team. If a team owner moves from Team to another plan, all team members are deactivated and lose access to shared team data.

6. Email Communications

We send the following types of emails:

Transactional (required): Welcome emails, team invitations, security breach notifications, and Terms/Privacy updates. You cannot opt out of these.
Notifications (optional): Scan completion alerts, trial ending reminders, and weekly digests. You can manage these through your notification preferences in Settings.

We use Brevo (see Section 7) to send emails. Scan completion alerts, trial reminders and weekly digests can be switched off in Settings. We also send a few onboarding emails in your first week and reminders to review your Trust Page; these have no setting yet. You can stop them with the one-click unsubscribe link in the email, or by emailing admin@xploitscan.com. We may occasionally email you about XploitScan, such as a feedback survey or an offer. Every such email has a one-click unsubscribe link that works without signing in.

7. Third-Party Services

We use the following third-party services to operate XploitScan. Each has their own privacy policy:

Clerk — Authentication and user management. Handles sign-up, sign-in, and session management. Receives your email address and profile information. If you arrived from a campaign link or another website, Clerk also receives those short labels (see Section 10) during sign-up. After the signup event is recorded, we remove them from your account. If removal fails, they stay with your account details at Clerk until your account is deleted.
Stripe — Payment processing. Handles all billing for paid subscriptions, including plan changes and proration. Receives your payment information directly; we never see your full card details.
Turso — Database hosting for application data (account info, scan results, including masked secret previews, and AI review decisions, team data). We do not store full source trees in the database.
Vercel — Application hosting for our web app and scan API. May collect standard server logs including IP addresses and request data. We use aggregate analytics for performance monitoring.
Brevo — We use Brevo to send transactional and onboarding emails such as welcome emails, scan notifications, team invitations, and trial reminders, and occasional product emails such as surveys and offers. They receive recipient email addresses and email content.
Survey tool (Tally) — If you answer a survey we send, it receives your answers and a random response token. It does not receive your name or email.
Sentry — Error monitoring. This may include browser information, IP addresses, and error stack traces. It does not include your source code.
Product analytics provider (PostHog): With your consent, receives page views and product events, your browser user agent and, if you are signed in, your account ID and email address. Whether or not you consent, it also receives the anonymous operational events described in Section 10, which contain no account ID, IP address, or linking identifier.
Anthropic (AI analysis) — When AI-powered features are enabled (false positive filtering and contextual analysis during scanning), excerpts of your source code relevant to specific scan findings are sent to Anthropic’s API for analysis. If you use AI answer scoring on a security questionnaire (Pro), the questions and answers you submit are also sent to Anthropic for scoring. Anthropic processes this content as a data processor on our behalf. Per Anthropic’s API terms, submitted content is not used to train their models and is deleted by Anthropic within 30 days (longer only where Anthropic must enforce its Usage Policy or comply with the law). Only the code around each finding (the flagged line and up to 10 lines either side) is sent, not entire files. The excerpts are sent in real time during the scan. For signed-in scans we keep Anthropic's review decisions and short reasons in our own database, as described in Section 2, but not the excerpts themselves. Code the CLI sends to Anthropic using your own ANTHROPIC_API_KEY goes under your own agreement with Anthropic, not through XploitScan. You can turn AI review off. In Settings, switch off “Send code excerpts to Anthropic for false-positive filtering” and no part of your code is sent to any third-party AI provider — scans then run entirely within XploitScan, at the cost of more false positives. The setting applies to scans you start from the Scan page while signed in, scans from the homepage and demo scanners while you are signed in, and GitHub App pull-request checks. Scans run without signing in, including anonymous homepage and demo scans and anonymous API requests, are not sent for AI review.

8. International Data Transfers

XploitScan is operated from the United States. Most of our service providers process data in the United States; our email provider (Brevo) and survey tool (Tally) process it in the European Union. If you are accessing the Service from outside the United States, please be aware that your data may be transferred to, stored, and processed in those locations. By using the Service, you consent to those transfers. Where our sub-processors offer data processing terms, including standard contractual clauses, we rely on those terms for international data transfers.

9. Data Retention

The only scheduled deletions are error logs (below), the demo scan limit records for visitors who aren't signed in, which we delete within 48 hours (see Section 2), and the daily purge of agreement records 1 year after account deletion. We keep your data while your account is active. You can delete individual scans yourself at any time, and deleting your account from Settings removes your account data, with the exceptions noted below. In detail:

Account data: Retained as long as your account is active. Deleted when you delete your account from Settings → Danger Zone.
Scan data: The scan results described in Section 2 for signed-in scans are retained as long as your account is active, on every plan (Free, Pro and Team). You can delete individual scans from your dashboard at any time, and they are deleted when you delete your account. Results of GitHub App pull-request checks are stored with the GitHub installation rather than your account, so account deletion does not remove them; email admin@xploitscan.com to have them deleted.
Full source uploads: Not retained as a project archive after scanning. Only the finding records described above are kept for signed-in scans.
Team data: Team membership records are retained as long as the team exists. When a member is removed, their record is kept and marked as removed, so the team owner can restore them, until the owner deletes it permanently (from Settings → Team, while the team's plan is active) or deletes their account.
Audit logs: Retained for security and accountability purposes while your account is active, and deleted with your account, except the record of your agreement described below.
Record of your agreement: When you create an account, we record when you accepted our Terms of Service and Privacy Policy, which versions you accepted, and how you signed up (for example, email, Google, or GitHub). This record does not include your name, email address, or IP address. We keep it while your account exists and for 1 year after you delete your account, so we can show what was agreed if a dispute arises, and then delete it.
Email suppression list: We keep a keyed hash of unsubscribed addresses and of addresses from our earlier email provider’s bounce and spam history, used only to make sure we don’t email that address again. The hash cannot be turned back into the address. It is kept after you delete your account. New bounces and spam reports are also blocked by our email provider (Brevo), which keeps its own list of those addresses.
Shared checklists: Shared checklist links stop working 30 days after they are created. The checklist data behind them is kept until you delete your account.
Free Trust Pages: A page you claimed is deleted with your account. A page created without an account is kept until you ask us to remove it at admin@xploitscan.com.
Referral data: Referral codes and referral tracking records are retained as long as your account is active.
Free trial records: When you start a free trial, we keep a one-way keyed hash of your email address and of your card's Stripe fingerprint, to stop repeat free trials. It is kept after you delete your account, no longer linked to it, and cannot be turned back into your email or card number.
Payment records: Retained as required by tax and financial regulations, typically 7 years.
Error logs: Retained for a limited period for debugging purposes, then automatically deleted.

10. Cookies and Tracking

We use the following cookies and tracking technologies:

Authentication cookies: Required for sign-in and session management. These are strictly necessary for the Service to function.
Analytics: With your consent, PostHog records the pages you visit and product events (such as starting a scan or a checkout). If you are signed in, these events are linked to your account ID and email address. Also with your consent, Vercel Analytics and Vercel Speed Insights collect aggregate, cookieless page-view and performance data. None of these load in your browser unless you accept analytics in the cookie banner, and none use cookies for cross-site tracking.
If you decline analytics, our servers still record a small number of anonymous operational events, such as a scan that failed (the stage it failed at, the error type, how long it ran, and the number and total size of files), starting a checkout or clicking a checkout button (the plan and billing interval selected, and which button was clicked), and product milestones such as signing up, starting a demo scan, saving a scan, completing a first or later scan, or a successful payment (not the amount). In milestone events, details about your activity are sent only as groups or ranges, such as the week or month you signed up, the time since you signed up or since your first scan, whether it is your first, second, or a later scan, and the number of files and findings. Milestone events can also include general context such as your plan, billing interval, trial or founding-rate status, how you signed up, and the page or feature involved. A signup event can also include where you came from: a short source name from the link you first used, the campaign fields on that link (utm_source, utm_medium, and utm_campaign), and the name of the website that referred you. These are short labels. They don't include your account ID, your IP address, or a full web address. We set a first-party cookie named xs_signup_source that holds only those labels for up to 7 days, so a signup can be counted by where it came from, and we set it only if you accept analytics. If you choose Essential only, we delete this cookie and don't set it again. It is not an advertising cookie and is never shared with advertisers. Each event records the time it happened, but is sent to PostHog without your account ID, IP address, or any identifier that links it to you or to other events. We use these events only to keep the Service working and to measure overall demand and product use.
Error monitoring: May use a session identifier to group error reports. Does not track you across other sites.

We do not use advertising cookies, retargeting pixels, or share cookie data with advertisers.

11. Security Measures

We take security seriously (we are a security company, after all). Our measures include:

All data transmitted to and from XploitScan is encrypted using TLS/HTTPS
Uploaded source files are processed in memory and are not stored; we keep only the scan results described in Section 2, which include masked secret previews but not your code.
Access to production systems is restricted
Authentication is handled by Clerk, an industry-leading auth provider
Payment data is handled entirely by Stripe, a PCI-compliant processor
Application errors are monitored via Sentry for rapid incident response
Our own code is scanned with XploitScan on every pull request and every push to our main branch, and Dependabot checks our dependencies for updates weekly

While we work hard to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security. In the event of a data breach affecting your personal information, we will notify affected users within 72 hours of becoming aware of the breach, as well as any applicable regulatory authorities as required by law.

12. Your Rights

You have the right to:

Access your data: Request a copy of all personal data we hold about you.
Export your data: Download your scan history and account information in a portable format.
Delete your data: Request deletion of your account and associated data. A few records are kept after deletion, as described in Section 9: the record of your agreement, the email suppression list, free-trial records, payment records, and GitHub App pull-request check results stored with the installation. We will process deletion requests within 30 days.
Correct your data: Update or correct any inaccurate personal information.
Withdraw consent: Where we rely on your consent for data processing, you can withdraw it at any time.
Manage email preferences: Opt out of scan completion alerts, trial reminders and weekly digests through your account settings at any time, and of our other non-essential emails with the one-click unsubscribe link in those emails or by emailing admin@xploitscan.com.

To exercise any of these rights, contact us at admin@xploitscan.com.

13. California Residents (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights regarding your personal information:

Right to Know: You have the right to know what personal information we collect, use, and disclose about you.
Right to Delete: You have the right to request deletion of your personal information.
Right to Opt Out: You have the right to opt out of the sale of your personal information.
Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

We do NOT sell personal information. We do not share personal information for cross-context behavioral advertising purposes. To exercise any of these rights, contact us at admin@xploitscan.com.

14. European Users (GDPR)

If you are located in the European Union or European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR), including:

Data Portability: The right to receive your personal data in a structured, commonly used, and machine-readable format.
Right to Restrict Processing: The right to request that we limit the processing of your personal data.
Right to Object: The right to object to the processing of your personal data.
Right to Erasure: The right to request deletion of your personal data (“right to be forgotten”).

Our legal basis for processing your personal data is contract performance (providing the Service) and legitimate interests (improving the Service and ensuring security). Demo scan limits: our legitimate interest in preventing abuse of free scans run without an account. Our sub-processors handle personal data under the data processing terms they offer. You can exercise your rights by contacting us at admin@xploitscan.com or lodge a complaint with your local data protection authority.

15. Connecticut Residents (CTDPA)

If you are a Connecticut resident, the Connecticut Data Privacy Act (CTDPA), in effect since July 1, 2023 and amended effective July 1, 2026, provides you with the following rights regarding your personal data:

Right to Access: You have the right to confirm whether we are processing your personal data and to obtain a copy of that data.
Right to Correct: You have the right to correct inaccuracies in your personal data.
Right to Delete: You have the right to request deletion of personal data you have provided or that we have collected about you.
Right to Data Portability: You have the right to obtain a copy of your personal data in a portable, readily usable format.
Right to Opt Out: You have the right to opt out of the processing of your personal data for purposes of (i) targeted advertising, (ii) the sale of personal data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. We do not sell personal data, engage in targeted advertising, or use automated profiling for consequential decisions, so this right is not currently applicable — but we will respect opt-out requests if our practices change.

Automated Processing Disclosure: XploitScan uses automated analysis (including AI/ML techniques) to scan your code for security vulnerabilities and map findings to compliance controls. This processing is performed on code you voluntarily submit for scanning. We do not use automated processing to make decisions that produce legal or similarly significant effects about you as a person.

Response Timeline: We will respond to verified requests within 45 days of receipt. If we require additional time (up to 45 additional days), we will notify you of the extension and the reason within the initial 45-day period.

Appeal Process: If we decline to act on your request, we will notify you within 45 days with the reason for our decision. You may appeal that decision by emailing admin@xploitscan.com with the subject line “CTDPA Appeal” and a description of your original request and why you believe it should be granted. We will respond to appeals within 60 days. If your appeal is denied, you may contact the Connecticut Attorney General’s office at portal.ct.gov/AG.

To submit a data rights request, contact us at admin@xploitscan.com with the subject line “CTDPA Request”. We may need to verify your identity before processing your request.

16. Children’s Privacy

XploitScan is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from individuals under 18. If we learn that we have collected data from a person under 18, we will delete it promptly.

17. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by email or through the Service and update the “Last updated” date at the top of this page. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

18. Contact Us

Contact us. XploitScan is operated by Cipherline LLC, a Connecticut limited liability company. For privacy questions or to exercise your rights, email admin@xploitscan.com. We respond within 30 days.