At Sectora, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our application security platform.
1. Information We Collect
We collect information you provide directly to us, including: • Account Information — when you create an account, we collect your email address and name. • Scan Data — when you run scans, we process and store information about your applications, including URLs, vulnerabilities found, and scan configurations. • Usage Data — we collect information about how you use our service, including features used, pages viewed, and actions taken. • Device Information — we collect information about the device and browser you use to access our service.
2. How We Use Your Information
We use the information we collect to: • Provide, maintain, and improve our services • Process and complete security scans • Send you technical notices, updates, and security alerts • Respond to your comments, questions, and support requests • Monitor and analyze trends, usage, and activities • Detect, investigate, and prevent fraudulent transactions and other illegal activities
3. Data Retention
We retain your personal information for as long as your account is active or as needed to provide you services. Scan results are retained for 90 days by default, though you can configure longer retention periods. You can request deletion of your account and associated data at any time by contacting us at privacy@sectora.io.
4. Data Security
We implement appropriate technical and organizational measures to protect your personal information, including: • Encryption of data in transit (TLS 1.3) and at rest (AES-256) • Regular security assessments and penetration testing • Access controls and authentication requirements • Monitoring and logging of access to sensitive data For more details, see our Security page.
5. MCP Server (mcp.sectora.io)
When you use the Sectora MCP endpoint at mcp.sectora.io/mcp, we log each request for abuse detection, rate-limit enforcement, and service reliability. What we log: • Request metadata — a unique request ID, the JSON-RPC method name, and (when applicable) the tool name called • Connection metadata — IP address, country (derived from IP), and User-Agent • Performance data — latency, HTTP status code, success/failure • API key prefix (first 12 characters) — only for authenticated requests; the full key is never logged • Timestamp • Tool arguments for account-scoped tools only — when you call a tool that acts on your own Sectora account (list_my_findings, list_my_scans, get_scan, scan_url, get_my_posture), and you authenticate with an API key, we keep a short summary of its arguments, capped at 512 characters. Arguments named like a key, secret, token, or password are replaced with a placeholder, and for any URL we keep only the address and path — never a username, password, query string, or fragment. We keep this so a compromised API key can be investigated. Calls made without an API key are rejected and their arguments are not recorded. What we do NOT log: • Tool arguments for the public threat-intelligence tools — we do not record the CVE IDs, keywords, technologies, or IP addresses you look up • Tool response content — we do not store what the tool returns to you • Full API keys • Any other payload you send or receive through the MCP Retention: raw request logs are kept for 30 days, after which they are permanently deleted. Before deletion, each day is reduced to aggregate counts (requests, errors, latency, and totals by tool, country, and error type). These aggregates contain no IP addresses, API keys, or arguments and are kept to show usage trends. Use of logs: abuse detection, rate-limit accounting, billing for authenticated tiers, and internal service improvement. Logs are not shared with third parties except when legally required. Free-tier users: anonymous usage is identified only by IP address and, if used, the first 12 characters of your API key. There is no correlation to your Sectora account unless you are signed in.
6. Data Sharing
We do not sell your personal information. We may share your information only in the following circumstances: • With your consent — we may share information when you give us explicit permission • Service Providers — we use third-party services to help operate our platform (hosting, email, analytics) • Legal Requirements — we may disclose information if required by law or to protect rights, safety, or property • Business Transfers — if we are involved in a merger or acquisition, your information may be transferred
7. Your Rights
Depending on your location, you may have certain rights regarding your personal information: • Access — request access to your personal information • Correction — request correction of inaccurate information • Deletion — request deletion of your personal information • Export — request a copy of your data in a portable format • Opt-out — opt out of marketing communications To exercise these rights, contact us at privacy@sectora.io.
8. Cookies and Tracking
We use cookies and similar technologies to: • Maintain your session and authentication state • Remember your preferences • Understand how you use our service • Improve our platform based on usage patterns You can control cookies through your browser settings.
9. International Data Transfers
Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your information in accordance with this privacy policy.
10. Changes to This Policy
We may update this privacy policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last Updated" date.
11. Sectora Browser Shield (Browser Extension)
The Sectora Browser Shield browser extension is a managed security agent. When installed (typically deployed by your organization's IT administrator), it protects the browser from extension-based risk, phishing, and data theft, and reports security signals to your organization's Sectora console. What the extension sends to Sectora (https://sectora.io) once the device is enrolled with your organization: • Device & enrollment data — a random device identifier created by the extension, the browser and its version, the operating system, whether the browser is centrally managed, and the enrollment credential that binds the device to your organization. • Your email address — only if your organization turns on identity reporting. It comes either from your organization's device-management (MDM) configuration or, on self-serve devices, from your signed-in Chrome profile — and then only after you click "Share my sign-in email with my organization" in the extension's options page and accept the browser's own permission prompt. The options page always shows what is reported; if you remove the permission, the email stops being reported. It is never collected on unenrolled or personal installs. • Installed-extension metadata — the id, name, version, install type, requested permissions, and enabled/disabled state of the extensions on the device, used to assess extension risk; plus an event when Browser Shield disables or re-enables an extension under your organization's policy, or when an extension gains new permissions in an update. • Protection status (a periodic heartbeat) — whether the device is in monitor or block mode, how current its threat list is, whether the privacy protections (WebRTC IP-leak and audio-fingerprinting prevention) were requested by your organization, are in effect, or were switched off by you on the device, and error flags when a protection could not run. • Security events — the finding type, verdict, severity, and the domain/host involved, for a flagged page, a risky download (the file type, never the file name or its contents), or a threat destination: for example, the site an authentication token or card/credential data was being sent to, or the host of an impostor login page. The token, card number, password, or other value itself is never sent — only that it was detected and where it was going. • WebRTC IP-leak events — when a web page discovers the device's own IP addresses through WebRTC, the event includes those IP addresses (up to six) so your administrator can see what was exposed. They are stored with that device's events and are left out of the console's fleet-wide views. • Block-exception requests — if you ask your administrator to unblock a site from the block page, the site's domain and the reason you type. • Uninstall notice — if the extension is removed, the browser opens a Sectora address carrying a one-time token, so your organization can see the device is no longer protected. If the extension is not enrolled with an organization, it only downloads Sectora's public threat list, with no identifier attached, and sends nothing else. What the extension does NOT collect or transmit: • Page content, the text you read, or anything you type into web pages • Form field values, passwords, credentials, authentication tokens, or card numbers • Downloaded file names or file contents • Your full browsing history of benign sites — only security-relevant events leave the device • Keystrokes Privacy by design: phishing, credential-theft, token-theft, and card-skimming detection runs locally inside the page; only the classification of what was found and, for a detected threat, the destination host leave the page — never the page's contents or your inputs. Use of this data: solely to provide the managed browser-security service to your organization (extension-risk assessment, threat blocking, and admin reporting). This data is not sold and is not used for advertising or any purpose unrelated to that security service. Retention & deletion: device records, extension inventory, and security events are kept while the device is registered with your organization. They are deleted when your organization's administrator removes the device from the Sectora console, or on request to privacy@sectora.io. Block-exception requests are kept as part of your organization's review history, without the link to the device, after the device is removed.
12. Contact Us
If you have questions about this privacy policy or our privacy practices, please contact us at: Email: privacy@sectora.io Address: Sectora Inc.