What this scanner processes, and why.

1. Scope and data controller

Securvex is an application that analyzes public websites. This policy applies to the deployment you are using. The organization or individual operating the deployment is the data controller for information processed through it. If this deployment has not configured a public contact channel, contact the operator of the site through the channel by which you reached it.

This policy does not govern third-party websites you scan or the services listed in the external services section. Those services have their own policies.

2. Data we process

Submitted URL and scan report

When you submit a URL, the scanner records the URL, normalized hostname and registrable domain, timestamps, scan status, verdict, score, findings, provider results, technical evidence, and recommended actions. Sensitive-looking query parameter values are replaced with [redacted] before the report is saved. The complete URL may still be sent to external services during the scan, as described below.

Reports are available through an unguessable link containing a random identifier. There is no public list of scans, no user account, and no scan history dashboard.

Technical logs

The application writes structured operational logs for events such as scan start, completion, failure, and retention cleanup. These logs may include a scan identifier, domain, status, score, duration, and error code. They are not intended to include API keys, page content, or full sensitive URLs. The hosting environment may independently collect IP addresses, request metadata, and access logs under the operator's configuration.

Rate limiting

To prevent abuse, the application may derive a short pseudonymous key from network request headers and a server-side salt. This key is held in process memory for rate limiting and is not stored in the scan-report database. When proxy trust is enabled, the operator must configure the proxy to supply a trustworthy client address.

Page content

The scanner retrieves a limited public HTML response for analysis. It does not submit forms, attempt logins, execute JavaScript, or download files. Extracted snippets may appear in the report as evidence. The full page HTML is not stored.

3. External services and disclosures

Scans may involve third-party services when the deployment configures them. The submitted URL or parts of it may be sent to those services:

• Phishunt community feed is downloaded by the deployment to check hostnames locally when PHISHUNT_ENABLED is not disabled. The submitted URL is not sent to it.
• Google Safe Browsing receives the URL whenGOOGLE_SAFE_BROWSING_API_KEY is configured.
• VirusTotal receives a URL identifier derived from the URL whenVIRUSTOTAL_API_KEY is configured.
• abuse.ch URLhaus receives the registrable domain whenURLHAUS_AUTH_KEY is configured.
• RDAP registries, reached through the public RDAP service, receive the registrable domain to retrieve registration data.
• DNS resolvers receive the hostname to look up public records.
• Configured AI endpoint, if enabled, receives structured scan evidence: the domain, verdict, findings, provider statuses, and limitations. The prompt is designed not to include the full query string or raw page HTML. The endpoint may be OpenAI or a self-hosted Ollama-compatible service selected by the operator.
• Hosting, database, and infrastructure providers process data on behalf of the deployment operator.

These providers may be located in other countries and may retain request data under their own policies. Securvex does not sell personal information or use it for advertising.

4. Cookies, analytics, and tracking

The application does not create user accounts and does not include advertising or analytics SDKs. It does not intentionally set marketing cookies. Copies of reports are stored on the server and accessed through their links. The deployment operator may add infrastructure-level analytics or logging; if so, this policy should be updated to describe it.

5. Retention

Scan reports are retained for a limited period, 30 days by default. The deployment operator can configure a different period with SCAN_RETENTION_DAYS. A cleanup job removes expired reports; expired or missing reports return a not-found page. Operational logs and infrastructure access logs may be retained separately under the operator's policy.

Do not submit URLs containing private tokens, passwords, personal information, or other secrets. Redaction reduces accidental storage of sensitive query values, but it is not a guarantee that every sensitive string will be recognized.

6. Security

Reports use unguessable identifiers and are served with no-store and no-index headers. The application applies SSRF controls, bounded response sizes and timeouts, redirect revalidation, server-side secrets, rate limits, and security headers. No internet-facing system is perfectly secure; the operator is responsible for TLS termination, access controls, backups, dependency updates, and infrastructure hardening.

7. Your choices and rights

Depending on your location, you may have rights to access, correct, delete, restrict, or object to processing of your personal information. Because there are no accounts, the operator may need the report link, the scanned URL, and the approximate scan time to locate a record. Requests can be sent through the contact channel described below.

Reports expire automatically. You can also avoid submitting personal or confidential information in URLs.

8. Contact

Privacy questions, deletion requests, and security reports should go to the operator of this deployment.

Changes to this policy

This policy may be updated when the application or legal requirements change. The effective date at the top of the page will be revised. Material changes should be communicated by the deployment operator through an appropriate channel.