Privacy Policy

1. Information we collect

From the contact form

Your name, email address, company name, role, the plan you asked about, and your message describing the systems you want reviewed.

From the client portal

Your name, work email, and company; a salted password hash (scrypt); and the engagement records you choose to add: target URLs, test usernames, test passwords, notes, and uploaded files. We also log timestamps and which user added each item.

From security reviews

Technical observations about the systems named in your signed scope, the HTTP/application evidence required to prove each verified finding, the list of external domains observed outside of scope, and the final reports and Letter of Attestation we deliver. We collect only the minimum evidence needed to demonstrate a finding to your team.

Automatically

Our hosting provider records standard HTTP server logs (IP address, request path, timestamp, and user-agent string) to keep the website and portal secure and prevent abuse.

2. How we use your information—and our zero-training policy

• To respond to your inquiry, confirm scope fit, and prepare a written scope and quote.
• To conduct the authorized security review, verify findings, run your complimentary re-scan, and issue your report and Letter of Attestation.
• To operate, authenticate, and secure the client portal.
• To meet legal, tax, accounting, and audit obligations in the United States and Canada.

Zero AI model training on client data: We run our own modified open-weight models in isolated environments and refine our testing logic by hand. We do not maintain a training dataset of client data, we never train or fine-tune models on your systems or findings, and we never feed your portal credentials or application responses into third-party consumer AI training pipelines.

3. How we protect your information

All traffic to this website and the client portal is encrypted in transit over TLS. Every record you add in the client portal (URL, username, password, and notes) is encrypted at the application layer using AES-256-GCM with a unique per-record initialization vector before it is written to the database. Portal login passwords are stored only as salted scrypt hashes, and eight failed login attempts lock an account for 15 minutes.

Files uploaded to the portal are stored in a private object store and are served only through an authenticated server route that verifies the signed-in user belongs to that client account (or our assigned review team). If we ever learn of a security breach affecting your data, we will notify you without undue delay.

4. Cookies

The public marketing site sets zero advertising, analytics, or cross-site tracking cookies. The client portal sets a single essential HttpOnly, Secure, SameSite=Lax session cookie when you sign in, which is cleared when you sign out or when the session expires.

5. Service providers and where data is processed

We never sell your information. We share data only with the infrastructure providers required to run the portal and reviews, under strict confidentiality obligations:

• Vercel (website and portal hosting, and private encrypted blob storage for portal files).
• Neon (managed Postgres database storing encrypted portal records in North America).
• Isolated model inference compute (dedicated, non-retaining GPU instances controlled by Raven Security during active review windows).
• Transactional email provider (such as Resend, used only when delivering contact form inquiries).

6. Retention and automatic credential deletion

You can edit or delete any login record or file you uploaded in the client portal at any time. In addition, we automatically purge stored test credentials 14 days after your complimentary re-scan is delivered, so old passwords do not sit in the portal indefinitely. We still recommend rotating or disabling temporary test accounts on your side once the re-scan finishes.

We retain signed scopes, invoices, and final reports/attestations only as long as required for contract administration, repeat re-verification requests, and US/Canadian tax and accounting rules—or until you ask us in writing to purge your engagement archive.

7. Your privacy rights (United States, Canada & international)

Depending on your jurisdiction—including under Canada's PIPEDA and provincial privacy laws (such as Quebec Law 25, Alberta PIPA, and BC PIPA), US state privacy laws (such as the CCPA/CPRA), or the GDPR—you have the right to request access to, correction of, export of, or deletion of your personal information. Write to hello@ravensec.com and we will respond promptly.

8. Offices and privacy contact

Privacy requests and questions may be sent to hello@ravensec.com or by mail to either of our North American offices:

• United States: Raven Security LLC, 228 Park Ave S, Suite 41200, New York, NY 10003
• Canada: Raven Security Inc., 100 King St W, Suite 5600, Toronto, ON M5X 1C9