Privacy Policy

Last updated: November 2026

This is a starting template, not legal advice. Review it with a qualified lawyer before relying on it.

Who we are

scanners.network ("we", "us") provides authorized, observation-only security scanning and monitoring for domains you control. This policy explains what we collect, why, and who we share it with.

What we collect

We keep the minimum needed to run the service:

Account data — your email address and authentication data (passwords are stored only as salted hashes).
Domains you add — the domain names you ask us to monitor, and the proof-of-control records you publish to verify them.
Scan & monitor results — findings about your domains' DNS, TLS, HTTP headers, certificates and related configuration, tracked over time.
Alert preferences and delivery logs — your chosen channels, thresholds and a record of what we sent, so we can de-duplicate and respect your caps.

What we do not collect

We are observation-only. We do not store the contents of your web pages or files; the optional exposure check confirms only whether a sensitive path is publicly reachable, never its contents. If the breach monitor is enabled, we store only the names of breaches and a count of affected accounts — never the email addresses themselves.

Third parties we query on your behalf

Some checks send only your domain name, an IP address, or a software name/version — all already-public information — to public lookup services, and never your data:

Certificate Transparency logs (crt.sh, Cert Spotter) and RDAP (via rdap.org) for certificates and registration.
DNS-over-HTTPS resolvers (Cloudflare, then Google) for DNSSEC.
OSV.dev, CISA KEV and FIRST EPSS for vulnerability and exploitation data (software name + version, or a CVE id).
Optional, off unless you enable them with a key: Shodan (an IP address) and Have I Been Pwned (the domain). DNS blocklist operators are off unless you configure them.

Cookies

We use a single, strictly necessary session cookie to keep you signed in. We do not use advertising or cross-site tracking cookies.

Payments

If you subscribe to a paid plan, payments are processed by Stripe. We do not receive or store your full card details.

Retention

Scan records are kept for roughly 13 months, alert-delivery logs for about 6 months, and resolved findings for about 90 days. Account and domain data is kept until you delete it or close your account.

Your choices

You can add or remove domains, change alert preferences, export your data, and delete your account at any time. Removing a domain stops all scanning and monitoring of it immediately and deletes its associated records.

Security

Data is encrypted in transit. Access is restricted to your account, and every scan is gated on your verified consent for the specific domain.

Contact

Questions about this policy or your data: privacy@scanners.network.