Data processing

For the data you put into Vulnix to run a test (targets, test accounts, repository content, findings and evidence), you are the controller and Vulnix Dev, Inc. is the processor. For account, billing and product analytics data about the people who use Vulnix, we are the controller; that is covered by the Privacy Policy.

• We process customer data only to provide Vulnix to you, on your instructions as given by how you use the product and its settings, and not for any other purpose.
• We do not sell customer data.
• Staff reach customer data only through the staff console, which requires two-factor authentication, and every action is logged. See Security.

We use the providers on the subprocessors page, each under terms that protect the data. Our main infrastructure is in the EU (Frankfurt); where a provider processes data outside the EU, we rely on the safeguards the law requires, such as the European Commission's Standard Contractual Clauses.

We protect customer data with the measures described on the Security page. If we become aware of a breach that affects your data, we will notify you without undue delay, with what we know about its scope and what we are doing about it.

• We help you answer requests from the people whose data you have put in Vulnix; email support@vulnix.dev.
• When an owner deletes an organization, its targets, runs, findings, members and integrations are removed. Exploit evidence files are stored write-once and may remain for up to 365 days before they are deleted. Billing records stay with our payment processor for as long as tax and accounting law requires.

This page summarizes how we process your data. If your procurement or legal team needs a signed data processing agreement, email hello@vulnix.dev and we will send one.