Privacy Policy

1. Who is responsible

The data controller is [COMPANY LEGAL NAME], registered in Poland at [ADDRESS], trading as Cod3Lab. You can reach us about anything in this policy at privacy@cod3lab.com.

We process personal data under the EU General Data Protection Regulation (GDPR) and the Polish Act on the Protection of Personal Data of 10 May 2018.

2. What we collect and why

2.1 Account data

When you create an account we collect your email address, a password hash, your name if you give it, the organisation name, and your plan. If you subscribe to a paid plan, our payment provider (Stripe) collects your payment details; we receive only a customer reference, the last four digits of the card, the billing name and address, and invoices. We never see or store full card numbers.

Purpose and legal basis: to provide the Service you signed up for and to bill you (Article 6(1)(b) GDPR, performance of a contract) and to meet our accounting obligations (Article 6(1)(c)).

2.2 Scan data about domains you add

For each domain you add we store the domain name, discovered subdomains and their DNS records, TLS certificate details, HTTP response headers, the findings and scores derived from them, score history, and the raw evidence behind each finding. Certificates and DNS records sometimes contain personal data (for example a person's name in a WHOIS-derived certificate field or a hostname that includes a name). We process this data as it appears on the public internet and do not use it to identify individuals.

Purpose and legal basis: performance of the contract with the account holder (Article 6(1)(b)); for data about third parties that appears in public records, our legitimate interest in providing an accurate external security assessment (Article 6(1)(f)), balanced by the passive nature of the checks and the opt-out described in the Scanner Policy.

2.3 Breach-exposure data

The breach-exposure check (not yet available) queries the Have I Been Pwned domain search service for accounts on a verified domain that appear in known data breaches. We hold the results as counts and hashed identifiers only: the number of affected accounts per breach and a one-way hash of each affected address so we can detect changes between scans. We do not store the plaintext list of affected email addresses unless the verified domain owner explicitly requests it, in which case it is shown once and not retained. Breach data is only ever retrieved for domains whose ownership has been verified.

Purpose and legal basis: performance of the contract with the verified owner (Article 6(1)(b)) and the owner's legitimate interest in protecting its own users (Article 6(1)(f)).

2.4 Alert recipients and integrations

If you add email addresses or webhook URLs to receive alerts, we store them to deliver those alerts. You are responsible for having the right to add other people's addresses.

2.5 Usage and technical data

Our servers record the IP address, user agent, requested URL and timestamp of requests to the app and API, and application errors. We use this to keep the Service running, to enforce rate limits, to investigate abuse and to fix bugs (Article 6(1)(f), legitimate interest). The marketing site at perimeter.cod3lab.com sets no cookies and runs no analytics; the app uses only cookies that are strictly necessary for signing in.

2.6 Support and correspondence

If you email us, we keep the correspondence for as long as needed to deal with your request and for up to two years afterwards in case of follow-up questions.

3. Public scorecards

A public scorecard shows a domain name, grade, category scores and a summary of top findings. It contains only information that is observable from the public internet and never includes breach-exposure details or raw evidence. Domain owners can ask for a scorecard to be removed or for the domain to be excluded from the Service via abuse@cod3lab.com.

4. How long we keep data

5. Where data is stored

The Service is hosted on Amazon Web Services in the eu-central-1 (Frankfurt, Germany) region. Data is stored and processed within the European Union. Where a sub-processor is located outside the EU (see below), transfers are covered by the European Commission's adequacy decisions or Standard Contractual Clauses.

6. Who we share data with

We do not sell personal data, and we do not share it with advertisers. We share data only with the service providers we need to run Perimeter, each bound by a data processing agreement:

• Amazon Web Services (EU, Frankfurt): hosting, storage, backups and outbound email.
• Stripe: subscription billing and invoicing.
• Have I Been Pwned: breach-exposure lookups for verified domains; we send only the domain name.
• Public and licensed security datasets (certificate transparency logs, internet-scan and blocklist providers): we send only the domain name, hostname or IP address being checked.
• Error monitoring and uptime providers: technical error reports that may include an IP address or account identifier.

We may also disclose data where required by law or to protect the rights, safety or property of Cod3Lab, our users or the public, and we will tell you when we are allowed to.

7. How we protect data

Data is encrypted in transit (TLS) and at rest. Raw evidence is stored in private storage and accessed through short-lived signed links. Access to production systems is restricted to the people who operate the Service, authenticated with hardware-backed credentials, and administrative access to servers is only possible through audited session management rather than an open SSH port. Passwords are stored as salted hashes. We review the Service's own external posture with Perimeter.

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• rectify inaccurate or incomplete data;
• erase your data where there is no longer a lawful reason to keep it;
• restrict or object to processing based on legitimate interest, including processing of public data about a domain you control;
• portability of the data you provided to us, in a machine-readable format;
• withdraw consent at any time, where processing is based on consent;
• lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl). You may also complain to the authority in your own EU member state.

To exercise any of these rights, email privacy@cod3lab.com. We will respond within one month. We may ask you to confirm your identity, or, for requests about a domain, to demonstrate control of it.

9. Children

The Service is intended for businesses and adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has created an account, contact us and we will delete it.

10. Changes to this policy

We will update this policy when our processing changes, for example when a new check category or sub-processor is introduced. Material changes are announced to account holders by email before they take effect, and the current version is always available at perimeter.cod3lab.com/privacy.html.

11. Contact

[COMPANY LEGAL NAME]
[ADDRESS]
Poland

Privacy and data requests: privacy@cod3lab.com
Abuse, scanner opt-out and scorecard removal: abuse@cod3lab.com