Legal

Privacy

What we store

• For a free snapshot: the address you entered, the result, a keyed hash of your IP address for rate limiting, and the time. Anonymous snapshots are deleted after 30 days.
• For an account: your email address, organization details, websites you add, verification records, authorizations you sign, assessment results and evidence, reports, orders and subscription status.
• For businesses we contact directly: the business name, website, the contact details we used, our notes, and the passive snapshot we prepared. You can ask us to stop contacting you at any time using the link in any message, and we keep a suppression record so we do not contact you again.
• Payments are processed by Stripe; we never see card numbers. Email is sent through Resend; email bodies never contain findings or evidence.
• AI explanations are generated by a third-party model provider from finding evidence; customer identities are not sent.

Evidence and reports

Evidence and reports are accessible only to members of your organization, agency staff you have authorized, and Northstead Security administrators for quality review and support. Downloads and shared links are short-lived and can be revoked.

Retention and deletion

Account data is kept while the account is active and deleted on request, except records we must keep for billing or legal reasons.

Contact

Privacy questions: use the support address in your dashboard.