Loading the page
Loading…
What is stored, where, who else handles it, and for how long. It states what is true today, including what is missing. For how organisations are kept apart and how people sign in, see Security.
The database is in London (AWS eu-west-2, through Supabase). Backups are the database provider's.
| Provider | What it does | What it receives | Where |
|---|---|---|---|
| Supabase | Database, sign-in, file storage for supplier evidence, and the vault that holds integration keys | Everything an organisation adds or the product stores for it, including member email addresses | London (AWS eu-west-2, through Supabase) |
| Vercel | Runs the web application and its scheduled jobs | Requests and responses in transit; operational logs. No customer data is stored there | London (lhr1), pinned in vercel.json |
| Resend (optional) | Sends the weekly email and supplier emails | Recipient address, subject and the text of the email | The provider's own regions (not chosen by us) |
| Anthropic (optional) | Claude add-on, for organisations that have it: a plain explanation of why an item matters, drafted detection rules and block-batch explanations. Also tags public articles | Public article text; for the add-on also the organisation's sector, country, size and the vendors it runs, scoring signals as counts, technique ids and the indicators being explained. Never host names, device names, people or notes | The provider's own regions (not chosen by us) |
| Microsoft (Graph and Defender) (optional) | Reads your Defender software and vulnerability list, receives the indicators you push, and (only if an admin switches the hunt on) runs read-only hunting queries | Indicators being pushed or looked for. Defender returns software names, CVE ids, device counts and, from the hunt, up to five device names per indicator seen | Your own Microsoft tenant |
| crt.sh (public certificate logs) (optional) | Lists host names under your own domains from public certificate logs | Your domain names | The service's own (Sectigo) |
| Shodan InternetDB (optional) | Says which ports and known CVEs are reported on the public addresses of your hosts | Public IP addresses of your own hosts, one at a time | The service's own |
| Threat-intelligence sources you switch on (optional) | Reputation lookups and enrichment (for example VirusTotal, AbuseIPDB, GreyNoise, urlscan) | The single indicator being looked up (an address, domain, link or file hash), never other company data | Each source's own |
| Lookalike checks (urlscan.io, your reputation sources, domain registries) (optional) | Every new lookalike of your domains is previewed on urlscan.io, checked against each reputation source you set up, and its registration date read from the registry (RDAP, or WHOIS on port 43, which is not encrypted) | The lookalike domain name only (a domain someone else registered), never your own data | Each service's own |
| Data | Kept | Deleted automatically? |
|---|---|---|
| Sign-in log (time, address, browser) | 90 days | Yes |
| Saved answers from external reputation sources | 7 days | Yes |
| Rate-limit counters | 1 day | Yes |
| Closed access requests from the front page | 90 days | Yes |
| Feed run history (when each feed ran and what happened) | 90 days | Yes |
| Indicators (addresses, domains, links, hashes) from the feeds, with their sightings | Until 30 days after they expire; never while a block request refers to them | Yes |
| Indicators that have no expiry date, with their sightings | Until 365 days after any feed last reported them; never while a block request refers to them | Yes |
| How each item's score moved | 180 days | Yes |
| Cached views built from the intel for an organisation (the CVE watch, ranked actors, detection gaps, the scored dashboard), one row per view | Kept 10 minutes of use; not on the daily clean-up: a row is replaced when its view is rebuilt and all rows are removed when a member changes something | Not yet |
| Snapshots of the headline numbers on Today, the counts behind them and the threat level with its reasons (counts and public names only; no people, hosts or devices) | Kept 400 days; not on the daily clean-up: older ones are removed each time a new one is written | Not yet |
| Daily risk level and score for each organisation (board history) | 800 days | Yes |
| Exposures that were fixed (when they opened and closed) | 800 days after they were fixed | Yes |
| Saved shift handover notes | 400 days | Yes |
| This clean-up's own run log | 180 days | Yes |
| Indicators seen in your own telemetry (Microsoft Defender, and the logs of a connected Sentinel, Splunk or Elastic), with up to five device names each (mailbox addresses are never stored) | Not kept beyond the next hunt: replaced daily, cleared when the hunt or log search is switched off or its tool is disconnected, and cleared if no hunt has succeeded for 7 days | Not yet |
| Whether the Defender hunt is switched on, and the outcome of its last run (time, status, counts, error text) | Kept while the organisation exists; one row, no deletion schedule | Not yet |
| CVEs reported on your internet-facing hosts (host names and addresses from public certificate logs and Shodan InternetDB) | Not kept beyond the next check: replaced each time your domains are checked | Not yet |
| Detection rules you import (rule names and ATT&CK technique ids only, never the query) | Kept until you remove or re-import them; no deletion schedule | Not yet |
| Items marked not relevant, with the reason given | Kept; no deletion schedule. Reasons stop changing scores after 180 days, and an admin can reset what was learned | Not yet |
| Items marked relevant (more like this) | Kept; no deletion schedule. Marks stop changing scores after 180 days | Not yet |
| Tasks on items (action, asset, due date, status and who has it) | Kept; no deletion schedule (an owner decision is needed) | Not yet |
| Which tickets, channel posts or playbook runs were created from which item, with the ticket reference, link and last read status | Kept; no deletion schedule (an owner decision is needed) | Not yet |
| Explanations written by Claude for items (Claude add-on): the text only, with who asked and when | Kept until the item is removed or the explanation is replaced; no deletion schedule | Not yet |
| How many Claude add-on requests an organisation made each month (a count only) | Kept; no deletion schedule (needed for billing) | Not yet |
| The record of privacy requests (exports, erasures, organisation deletions) with their dates and outcome, holding no names or emails | Kept; no deletion schedule, so a request can always be evidenced | Not yet |
| Audit log of changes in an organisation | Kept; no deletion schedule (an owner decision is needed) | Not yet |
| Threat items with their scores, notes and workflow | Kept; no deletion schedule yet (people's notes and ownership hang on them) | Not yet |
| When each dashboard action was first seen and when it stopped appearing (the action, never a person) | 400 days after the action stopped appearing; open ones are kept | Yes |
| Leak, breach, lookalike and supplier findings | Kept until reviewed or the item is removed; no deletion schedule yet | Not yet |
An organisation can ask in writing for its data to be returned or deleted when it leaves.
For a security questionnaire or a data processing question, use the request form. To report a vulnerability, see the security contact file.