Privacy Policy

1. Who is responsible

The data controller (responsable del tratamiento) is Andrés Fernández, a natural person doing business as Xtruct, in Bogotá, Colombia. Contact for anything about your data: andresf@xtruct.net.

When you scan your site, the responses we receive may happen to contain personal data of your own users or staff. For that data you are the controller and we process it only on your behalf, to produce your scan results.

2. What we collect

• Account: your email address, a user identifier and your password. Sign-in is provided by groveback, our database and authentication provider; xsec itself never stores your password. Your session tokens are kept in cookies (section 11).
• Companies and members: company name, members (user identifier, email, role), invitations (email, role, a hash of the one-time link, expiry), the plan, the monthly scan counter and any plan granted by our staff.
• Sites and scans: site address and host name, verification status and token, starting URLs, delegated verification links (a hash of the link and its expiry); for each scan, the target, status, type (full or passive), score, findings (address, parameter, evidence excerpt and remediation), coverage, an activity log, the full report file and, for passive scans of unverified sites, the attestation (who started it and their email, who authorized it, the reference and when).
• Billing events from Hotmart: when Hotmart notifies us of a purchase or subscription event we keep the event type, transaction code, subscription code, offer code, buyer email, the company and plan it applies to, its status and the time. We keep only those fields from Hotmart's notification. We do not receive card or bank details.
• Out-of-band collector (SSRF test): when a server we are scanning fetches our collector, we record a random code, the time and the source IP address of the request (usually the scanned server's). Never headers, bodies or the rest of the address. These records are kept in memory only, never in our database.
• Admin audit log: every change of plan or quota made by our staff or by a Hotmart event records who made it (user identifier and email, or "hotmart"), the company, the values before and after, the reason and the time.
• Server logs: our servers and our hosting provider record technical information about requests (time, address requested, response status and, at the hosting provider, IP address and browser) to run and secure the service. Scans keep a technical log of what they did.
• AI review of pull requests: when your CI runs xsec review with a CI token, it sends us the changed lines of a pull request (file paths, line numbers, the added lines and some unchanged lines around them), the repository name, commit and pull request link, and the findings of xsec's own rules. We remove secrets we recognize and send that code to OpenAI (section 6) to review it, and return the findings to your CI. The AI review itself stores no code (what the dashboard keeps of your CI runs is described next). We keep a record of each review: the company, site and CI token, the repository, commit and pull request link, how many files and lines it had, how many findings of each severity came back, the AI model, the tokens it used, how long it took and whether it worked; we use it for the monthly quota and to keep costs and abuse in check.
• Results of your CI runs: when the GitHub Action runs with a CI token (and upload is not turned off), on pull requests and on pushes, it sends what the code review and the dependency check found so your team sees it on the dashboard: for each code review finding, the file path, line number, the rule (or that the AI found it), severity, confidence, OWASP category, CWE, a title, the explanation and the fix, and the lines of code it is about (the flagged line and up to 3 lines on each side, with the secrets we recognize replaced by [redacted], never whole files); for each dependency, the package, its installed version, the advisory, the version to move to and the lockfile it is in; plus the repository, branch, commit, pull request and CI run links. We keep these with the company and only its members can see them.

We do not use advertising or analytics trackers, and we do not sell personal data.

3. Your Google account data

You can sign in to xsec with your Google account. Google then shares your name, email address and profile picture with groveback, our authentication provider (section 6), which signs you in to xsec. We ask Google only for basic sign-in access (openid, email, profile): we never see your Google password and get no access to your Gmail, Drive, contacts or any other Google service.

• How we use it: only to create your xsec account, sign you in and link your account to the companies you belong to. xsec keeps your email address and an account identifier; your name and picture stay with groveback.
• What we do not do: your Google data is not sold, not used for advertising, not shared with anyone except the providers in section 6 that run the service, and not used to train AI models.
• Removing it: you can remove xsec's access at any time at myaccount.google.com/permissions, and ask us to delete your account and its data by writing to the address in section 1 (section 8 says how long that takes).

Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

4. Why we use it

• to provide the service: accounts, companies, invitations, site verification, scans, reports and the seal;
• to activate, renew and end paid plans from Hotmart's notifications, and to answer billing questions;
• to keep the service secure and prevent abuse: the ownership gate, attestations, quotas and the audit log;
• to give you support and tell you about important changes to the service, these documents or your plan;
• to meet legal, accounting and tax obligations and to respond to authorities.

5. Legal basis

We process your data with the authorization you give when you create an account and accept this policy, and as needed to perform our contract with you and to comply with the law. If you are in the European Union or another place with similar rules, the bases are the performance of the contract, our legitimate interest in securing the service and preventing abuse, and compliance with legal obligations.

6. Who processes data for us

We share data only with the providers needed to run xsec, each for its task:

• groveback: database, authentication (including sign-in with Google, section 3) and private file storage for reports, on servers in the United States.
• Vercel Inc.: hosts the dashboard you use in your browser; your requests pass through its servers (United States and its global network).
• Hetzner Online GmbH: servers in Falkenstein, Germany, that run our Kubernetes cluster: the API, the scans and the out-of-band collector.
• Hotmart: sells and processes payments for paid plans. For the data you enter at its checkout, Hotmart acts under its own privacy policy. Our checkout link sends it your company's identifier so that the payment reaches the right company.
• Cloudflare, Inc.: its public DNS resolver is used to read the TXT record when a site is verified; it receives the host name being verified.
• OpenAI, L.L.C.: reviews the code your CI sends for AI review (section 2), through its API, in the United States. We ask it not to keep the request for its own use (store: false); under OpenAI's API data policy, data sent to its API is not used to train its models and may be kept for up to 30 days to detect abuse, then deleted.

We may also disclose data when the law or a competent authority requires it.

7. International transfers

Because of the providers above, your data is stored or passes through servers outside Colombia, among them in Germany, the United States and Brazil (Hotmart). We choose providers that protect data adequately, as Ley 1581 de 2012 requires; by accepting this policy you authorize these transfers.

8. How long we keep it

• Account, companies, sites, scans and reports: while your account or company is active. Ask us to delete them and we will do so within 30 days, except what we must keep by law.
• Invitations: valid for 7 days; a revoked invitation is deleted, an accepted one is kept with the company as a record of who joined. Delegated verification links: valid for 14 days and useless once the site is verified.
• Out-of-band collector records: in memory for minutes only; they disappear when the scan reports or shortly after its time limit, and with any restart.
• Code sent for AI review: held in memory only while the review runs, never written to our database or logs. The record of each review (section 2, without code) is kept with the company.
• Scan workloads: each scan runs in a temporary container that is deleted about 10 minutes after it finishes. Technical logs: up to 30 days.
• Billing events and the admin audit log: for as long as needed for accounting, tax and dispute purposes: 10 years, as Colombian accounting law requires for books and supporting records.
• Cookies: see the table in section 11.

9. How we protect it

• Your browser never holds a database key: the dashboard calls our API from the server, your session tokens are in HttpOnly cookies, and the API checks on every request that you belong to the company whose data you ask for.
• Secrets live only on the server. One-time links (invitations, verification links) are stored only as hashes. Reports are kept in private storage and handed out through short-lived signed links.
• Each scan runs in an isolated, disposable container with no privileges, no access to our cluster's credentials and no incoming connections, and the scanner refuses private and internal addresses.
• Our staff can change a company's plan or quota only through an allowlist held on the server, cannot see a customer's sites, scans or findings that way, and every such change is written to the audit log first. Hotmart's notifications are accepted only with a shared secret.

No system is completely secure. If an incident affects your personal data we will tell you and, where the law requires, the Superintendencia de Industria y Comercio.

10. Your rights

Under Ley 1581 de 2012 you have the right to:

• know, update and correct your personal data;
• ask for proof of the authorization you gave us;
• be told how we have used your data;
• revoke your authorization and/or ask us to delete your data, when there is no legal or contractual duty to keep it;
• access your data free of charge;
• file a complaint with the Superintendencia de Industria y Comercio (SIC) once you have contacted us first.

To exercise them, write to andresf@xtruct.net from the email of your account, saying what you are asking for. We answer queries within 10 business days (extendable by 5) and claims within 15 business days (extendable by 8), as the law sets. If you are in the European Union or a similar jurisdiction you also have the rights of access, rectification, erasure, restriction, portability and objection, and may complain to your data protection authority.

xsec is meant for businesses and is not directed at minors.

11. Cookies

The dashboard sets only its own cookies, all needed for it to work. None is used for advertising or analytics, so there is no consent banner.

• xsec_session: your access token, to keep you signed in. HttpOnly. Up to 30 days, removed when you sign out.
• xsec_refresh: a single-use token to renew your session; replaced on each renewal. HttpOnly. 30 days, removed when you sign out.
• xsec_locale: the language you chose (English or Spanish). 1 year.
• xsec_upgrade: while you pay on Hotmart, which company and plan you chose and when, so that you come back to the right company. HttpOnly. 30 minutes (10 minutes after you return).

Hotmart's checkout pages set their own cookies under Hotmart's policy.

12. Changes to this policy

We will publish any change on this page with a new date and, if it is significant, tell you in the dashboard or by email before it applies.

13. Contact

Andrés Fernández (Xtruct), Bogotá, Colombia. Email: andresf@xtruct.net.