Privacy Policy

1. Data we process

Account data: email address, optional name, organization name, and membership role.

Verification data: the domain submitted, the issued challenge value, and the results and timestamps of verification checks.

Engagement data: requests, authorization records including the source IP address and user agent at the moment of acceptance, status history, and uploaded reports.

Access data: authentication events, download events, and an audit trail of operator actions.

Authenticated-test material: any test account, token, or instructions an organization supplies for an engagement. Secrets are encrypted before storage and are readable only by operators.

2. Why we process it

To operate the service: authenticate users, verify domain control, schedule and deliver engagements, and notify the organization of status changes.

To keep an accurate record of authorization. The attestation, its version, the timestamp, and the source address are retained because they are the evidence that testing was authorized.

To secure the service: rate limiting, abuse prevention, and investigation of misuse.

3. Sharing

Reports are visible only to members of the organization that commissioned them and to Syrah operators.

Infrastructure providers process data on our behalf: Cloudflare for hosting, storage, email delivery, and access control; Resend for transactional email.

Model providers: for free engagements, engagement data is sent only to providers operating under zero-data-retention terms, meaning it is not stored by the provider after the request completes and is not used to train models. For Pro engagements, models are deployed in our own infrastructure within the European Union and engagement data does not leave that region for inference.

4. Retention

Account and engagement records are retained for as long as the account exists plus the period required to demonstrate authorization.

Magic-link tokens expire after fifteen minutes. Sessions expire after seven days.

Audit records are append-only and are not deleted through the application.

5. Your rights

You may request access to, correction of, or deletion of your personal data by contacting security@syrah.dev. Deletion of authorization records may be declined where retention is required to demonstrate that testing was authorized.

Engagement artefacts submitted to a model provider under zero-retention terms are not retained by that provider, so there is nothing to delete on their side.