Privacy Notice
Last updated 2026-10-19
This notice explains which personal data secscan processes, why, on which legal basis, for how long, and which rights you have under the EU General Data Protection Regulation (GDPR). secscan is built to need as little personal data as possible: uploads are analysed in isolated sandboxes and deleted right after the scan, and there is no advertising tracking.
1. Controller
The controller responsible for data processing is Jan Gebser, trading as NETCORE MEDIA, Ochsenweberstraße 25b, 22419 Hamburg, Germany; email info@netcore.digital. See the Imprint. We have not appointed a data protection officer, as we are not legally required to. For all privacy questions, write to the address above.
2. Overview
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Delivering the website, security | IP address, time, address requested, browser | Art. 6 (1) (f): secure, stable operation |
| Account and sign-in | Email, password hash, optional profile, sign-in history | Art. 6 (1) (b): contract; (f) account security |
| Scans and reports | Files you submit (briefly), file names, hashes, findings | Art. 6 (1) (b): the service you request |
| Guest scans | Random browser identifier, IP address | Art. 6 (1) (f): fair-use limits, abuse prevention |
| Community | Posts, images, display name, reports | Art. 6 (1) (b): participation you choose |
| Customer success | Name, business email, company, message | Art. 6 (1) (b) pre-contractual steps; (f) answering enquiries |
| Audience measurement | Page address, referrer, screen size, IP address, browser | currently not active |
3. Visiting the website
When you open a page, the web server records your IP address, the date and time, the address requested, the HTTP status, the amount of data sent, the referring page and your browser's identification (user agent). We need this to deliver the pages, to detect and fend off attacks and to fix errors (Art. 6 (1) (f) GDPR). Server logs are rotated daily and deleted after 7 days. The site loads no fonts, scripts or images from third parties.
To show how many people are online right now, we store a one-way hash of your session identifier, whether you are signed in and the time of your last page view, without IP address; these entries are deleted after one hour (Art. 6 (1) (f) GDPR).
4. Cookies
secscan only uses cookies that are strictly necessary for the service you request (§ 25 (2) no. 2 TDDDG); no consent is needed for them:
| Cookie | Purpose | Lifetime |
|---|---|---|
__Host-secscan | Session: keeps you signed in, protects forms against forgery (CSRF), remembers the sign-in step you are on | Until the browser is closed; expires after 60 minutes without activity |
guest | Random identifier for guest scans, so you can see your results and the weekly guest limit can be applied. Only a hash of it is stored on our side. | 7 days, set only when you start a guest scan |
theme | Remembers light, dark or system colour mode | 1 year, set only when you choose a mode |
lang | Remembers the language you chose | 1 year, set only when you choose a language |
When you write a community post, the unfinished text is kept in your browser's local storage, so a draft is not lost if the page is closed. It never leaves your device until you post it, and it is removed when you send the post (§ 25 (2) no. 2 TDDDG: needed for the writing function you use).
5. Audience measurement
secscan currently uses no audience measurement. If this changes, this section will describe it before it starts.
6. Your account and sign-in
For an account we store your email address, a hash of your password (Argon2id; we never know the password itself), your plan and, only if you enter them, your name, picture, website, job title, industry and company. Sign-in uses several steps (security image, email code, password, optionally an authenticator app); for this we process one-time codes that expire after a few minutes.
To protect your account we record sign-ins, failed attempts, password resets and security changes with time, IP address and browser (Art. 6 (1) (f) GDPR). You see this history in your profile and, if you choose, in periodic sign-in reviews by email. Sign-in history is deleted after 400 days; records of failed attempts used for rate limiting after 24 hours.
Account data is kept until you delete your account in your profile; deletion removes your scans, reports, API tokens, domains and platform links at once. Data we must keep for tax or commercial reasons (for example invoices for Pro) is kept for the statutory periods (up to 10 years, Art. 6 (1) (c) GDPR).
7. Scans and reports
Files you upload or import (from GitHub or a web address) are analysed automatically in isolated containers without network access and are deleted immediately after the scan. Unfinished uploads are deleted after 24 hours. Please do not submit personal data of others; the service is meant for code, websites and suspicious files, not for documents about people.
The report (file names, hashes, findings with short code excerpts, technical details) is kept for 30 days and can be deleted by you at any time. Leaked secrets found in your files are masked in reports. Guest scans that are not claimed by registering within 24 hours are deleted. For the weekly limits we record which account or guest identifier started a scan and from which IP address; these usage records are deleted after 400 days.
Public statistics contain only anonymous totals (numbers of scans, sizes, file types, verdicts) without any reference to a person. Pro users can have a report sent by email.
8. Website scans and domains
For website scans we store the address you enter and the scan result like any other report. The scan connects to that website from our servers; the website's operator sees our server address, not yours. Full scans require proof that you control the domain; for this we store the domain, a verification token and the result of the check until you remove the domain.
9. Community
Posts, images and your community name are public. Every account receives a random community name at registration, which you can change; your real name, email address and account number are never shown in the community. Images are converted (which removes embedded metadata such as location data). We store reports of posts and moderation actions. Posts stay until you or a moderator delete them; when you delete your account, your posts are shown as written by a "Former member".
The private sponsor area of the community is visible only to active sponsors and our team; its posts are stored encrypted.
Invitations. If you register through a member's personal invitation link, we store which member invited you (Art. 6 (1) (f) GDPR: crediting the invitation). The inviting member sees only how many invited people joined and became Pro, not who they are, and earns badges for it. We never send invitation emails ourselves; members share their link personally.
10. Contact requests
When you use the customer-success form we process your name, business email, company and the details you enter, and the IP address of the request (abuse protection), to answer you and, where relevant, to prepare an offer. Requests are deleted 24 months after they were handled, at the latest 36 months after receipt, unless longer retention is required by law.
11. Partners, advertising and sponsors
Advertising spaces. Some pages show partner banners. They are images served from our own server; no third-party ad network, cookie or tracking script is involved. We only count, per banner and day, how often it was shown and clicked (two numbers, without IP address or any other data about you) and pass these totals to the partner in a report (Art. 6 (1) (f) GDPR: billing and reporting the booked advertising). When you click a banner, we forward you to the partner's website, where the partner's privacy notice applies.
Booking and sponsorship requests. When you request an advertising space or declare sponsorship interest, we process your company, name, email address, website, the image you upload and your message, and the IP address of the request (abuse protection), to handle the request, prepare and perform the contract and send the reports (Art. 6 (1) (b) GDPR). Business records such as invoices are kept as required by commercial and tax law (up to 10 years); other request data is deleted 24 months after the booking or the request has ended. Sponsors who agree to it are shown with name, logo and website on our sites and in a public list used by the other HEIMDALL platforms.
Partner programme applications. When you apply for a partner programme, we process your organisation, its size, your name, email address, website and message, and the IP address of the request (abuse protection), to assess the application and prepare a partnership (Art. 6 (1) (b) GDPR). Accepted partners are listed with organisation name and website in the public partner directory. Applications that are not accepted are deleted 24 months after the application.
12. API, CLI and connected platforms
For API access we store your tokens only as hashes, and a log of API requests (time, address, status, IP) for 90 days for security and fair use. The self-hosted CLI checks your licence online; the check transmits your token and the program name and version in the request header.
secscan is part of the HEIMDALL platform family operated by NETCORE MEDIA (including heimdall-security.net, netcore.digital, webservice.digital and us24.net). If you use secscan through one of these platforms, the platform and secscan exchange the data needed for that: your account email, name, plan and an internal ID, and the results of scans you start there. Each platform has its own privacy notice.
13. Emails
We send emails that are needed for the service: sign-in and verification codes, security notices (for example a new password or a reset of two-factor authentication), optional sign-in reviews and, for Pro, optional scan reports. You can switch the optional ones off in your profile. We send no newsletters or advertising.
14. Recipients and processors
- Hosting: Strato GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany (dedicated server in its Berlin data centre) (processor under Art. 28 GDPR).
- Email delivery: our mail server, and the email provider you use to receive messages.
- Connected HEIMDALL platforms, only as described in section 12.
- Authorities, only if we are legally obliged to disclose data.
We do not sell personal data and do not share it for advertising.
15. Transfers outside the EU
All processing takes place on servers in Germany. When you import a repository from GitHub, our server downloads it from GitHub, Inc. (USA); this request contains only the repository name, no data about you.
16. Retention overview
| Uploaded and downloaded files | deleted right after the scan; unfinished uploads after 24 hours |
| Scan reports | 30 days, or earlier when you delete them; unclaimed guest scans after 24 hours |
| Web server logs | 7 days |
| Sign-in history, usage records | 400 days |
| Failed-attempt records | 24 hours |
| API request log, webhook deliveries | 90 days |
| Contact requests | 24 months after handling, at most 36 months |
| Online counter | 1 hour |
| Partner programme applications | 24 months if not accepted; accepted partners for the duration of the partnership |
| Advertising and sponsorship requests | 24 months after the booking or request ended; invoices as required by law (up to 10 years) |
| Banner counts | daily totals without personal data, kept for the partner reports |
| Account, profile, community posts | until you delete them or your account |
17. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Much of this you can do yourself: your profile shows your data and sign-in history, scan reports can be downloaded as JSON and deleted, and the account can be deleted with all its data. For everything else, write to info@netcore.digital.
You may also lodge a complaint with a supervisory authority, for example the one responsible for us: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Straße 22, 20459 Hamburg.
We do not use automated decision-making within the meaning of Art. 22 GDPR. Scan verdicts assess files and websites, not people.
18. Security
Connections are encrypted (HTTPS). Submitted files are analysed in isolated containers without network access; downloads and website scans run in separate containers that can only reach public addresses. Passwords are stored as Argon2id hashes, API tokens as SHA-256 hashes, authenticator secrets encrypted. Access to administration is restricted to a private network, requires two-factor authentication and is fully logged.
19. Changes
We update this notice when the service or the law changes. The date at the top shows the current version.