Privacy Policy

Vulnary ("Vulnary", "we", "us", or "our") operates vulnary.com and the Vulnary platform: a software-as-a-service offensive-security service through which customers run and manage security engagements, including penetration tests, code review, and exploit verification, via our web portal. This Privacy Policy explains what personal data and customer material we collect, how and why we use it, who we share it with, and the rights you have over it.

This Policy applies to the Vulnary marketing site, the customer portal, and all related services (together, the "Services"). It does not apply to third-party websites, tools, or targets you choose to test, which are governed by their own terms.

Where we act as a data controller we decide how and why data is processed, for example your account and billing data. Where we handle material inside an engagement on your instructions, including code, scope, and credentials, we generally act as a data processor on your behalf, and your own agreement with us governs that processing.

Account and contact data. When you register or are invited to an organization, we collect identity and contact details such as your name, work email address, organization or team name, role, and authentication metadata. We use passwordless, magic-link sign-in, so we do not store account passwords.

Engagement inputs, including sensitive material. To run an engagement you provide the inputs that define and enable it. Depending on the engagement type, this can include highly sensitive material:

You are responsible for ensuring you are authorized to submit this material and to have us test the targets you define. Do not upload personal data that is not necessary for the engagement.

Bring-your-own AI-provider keys. Some plans let you bring your own AI-provider API key. Where you do, we store that key encrypted, use it solely to run your engagements, and never write it to logs. You may rotate or remove it at any time.

Automatically-collected and usage data. When you use the Services we automatically collect technical and usage data: IP address, device and browser type, pages and features used, engagement telemetry, timestamps, and diagnostic or error logs. We use this to operate, secure, debug, and improve the Services.

Billing data. Paid plans require billing information. Card and payment details are collected and processed directly by our third-party payment processor; we receive only limited billing metadata such as plan, transaction status, and the last four digits of a card. We do not store full card numbers.

Cookies. We use a small number of strictly-necessary and analytics cookies. See our Cookies Policy for details and your choices.

We do not sell your personal data, and we do not use your source code, credentials, or engagement inputs to train models or for any purpose beyond delivering your engagement.

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases:

Where we process engagement material on your behalf, your organization is the controller and determines the legal basis for that material; we act on your documented instructions as processor.

The material you entrust to us for an engagement, meaning source code, credentials, scope, and reports, is treated as highly sensitive and handled under strict controls:

We do not sell your data. We share it only with service providers ("subprocessors") who help us run the Services, and only to the extent needed. These include:

Subprocessors are bound by contract to appropriate confidentiality and security obligations. A current list of subprocessors is maintained in our Trust Centre. We may also disclose data where required by law or to protect our rights, and we may transfer data as part of a merger, acquisition, or reorganization, subject to this Policy.

We and our subprocessors may process data in countries other than your own. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses and equivalent UK and Swiss mechanisms, to ensure your data receives an adequate level of protection.

We keep personal data only as long as necessary for the purposes described in this Policy:

When a retention period ends, or on a valid deletion request, we delete or irreversibly anonymize the data.

We maintain technical and organizational measures designed to protect your data against unauthorized access, alteration, disclosure, or destruction, including encryption, environment isolation, least-privilege access, monitoring, and logging. No system is perfectly secure, but security is central to how the platform is built. You can read more about our practices in the Trust Centre.

Depending on where you live, including under the GDPR and the California Consumer Privacy Act, you may have the right to:

To exercise any of these rights, contact us at [email protected]. We will respond within the timeframe required by applicable law and may need to verify your identity. If we process material on behalf of your organization as a processor, we will direct your request to that organization, the controller. You also have the right to lodge a complaint with your local data protection authority.

The Services are intended for business use and are not directed to individuals under 18. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, contact [email protected] and we will delete it.

We use cookies and similar technologies for authentication, core functionality, and limited analytics. For details and your choices, see our Cookies Policy.

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date shown above and, where appropriate, notify you through the Services or by email. Your continued use of the Services after a change takes effect constitutes acceptance of the updated Policy.

For any privacy question or to exercise your rights, contact our privacy team, and Data Protection Officer where one is designated, at [email protected]. For the Data Protection Officer, mark your message for the attention of the DPO.