1. Introduction
VectraGuard ("we," "us," or "our") is operated by VectraGuard Security, Inc.. This Privacy Policy describes how we collect, use, disclose, and safeguard information when you visit our website or use our penetration testing and vulnerability scanning platform, and related services (collectively, the "Services").
The VectraGuard platform is currently available only through a private early-access pilot, and billing has not started. Where this policy describes accounts, scan data, and payments, it describes how the platform handles that information for pilot participants today and for customers once it is generally available.
By accessing or using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please discontinue use of our Services.
2. Information We Collect
2.1 Account Information
When you request early access or are given an account, we collect your name, email address, organization name, and contact details. When paid plans become available, a third-party payment processor will collect billing and payment information on our behalf.
2.2 Scan & Assessment Data
When you use the platform to perform vulnerability scans, we process target system addresses, scan configurations, scan results, vulnerability findings, severity ratings, and remediation tracking data. This data is accessible to authorized users within your organization and to VectraGuard personnel who need access to operate the platform or to deliver an engagement you have requested.
2.3 Usage & Platform Data
The platform records audit logs of user, IP address, action, and outcome, along with API access logs and system performance metrics. This helps us secure the platform, provide your organization with an audit trail, and troubleshoot issues.
2.4 Website & Technical Data
Our website is delivered through Cloudflare, which provides content delivery and the network connection to our servers. When you visit, Cloudflare and our web server may process standard request data such as your IP address, browser type, and the pages you request, in order to deliver and protect the site. Our website does not run analytics, advertising, or tracking scripts. See our Cookie Policy for what the website stores on your device.
2.5 Contact Form
If you use the contact form, we collect the name, email address, optional company, and message that you type. A small service we run sends them as a single email, through our email delivery provider Resend, to our contact inbox. We do not store form submissions in a database on the website. That service logs only the time, a hashed form of your IP address, and the outcome of the request, never the content of your message. The email stays in our inbox for as long as we need it to reply to you and keep our records. To have it deleted, write to [email protected]. The form is protected by Cloudflare Turnstile, a bot check described in section 9.
3. How We Use Your Information
3.1 Service Delivery
We use your information to perform vulnerability scans and assessments, generate security reports, provide customer support, maintain and improve our platform, and ensure service reliability.
3.2 Account Management
We use your information for user authentication and access control, subscription and billing management once billing starts, and communicating important service updates, security advisories, and policy changes.
3.3 Security & Compliance
We process information to detect and prevent fraud, enforce our terms of service, comply with legal obligations, and protect the security of our platform and users.
3.4 Communications
With your consent, we may send product updates, security research, newsletters, and event information. You can opt out of marketing communications at any time via the unsubscribe link in any email or by contacting us.
4. Data Sharing & Disclosure
4.1 Service Providers
We share information with third-party providers who help us operate our Services, such as hosting and cloud infrastructure providers for the platform and, once billing starts, payment processors. We limit what we share with them to what they need to provide their service to us. For the website and its contact form, the providers are:
- Cloudflare: content delivery and network protection for the website, and Turnstile, the bot check on the contact form. Cloudflare processes request data and Turnstile signals (such as your IP address, TLS fingerprint, browser user agent, and the site and origin being protected) on our behalf. Cloudflare says that, separately, it also uses Turnstile signals as an independent controller to improve its bot detection; see its Turnstile Privacy Addendum on cloudflare.com.
- Resend: email delivery. It transmits the contact-form message (name, email address, company, and message) to our inbox.
4.2 Legal Requirements
We may disclose your information when required by law, regulation, legal process, or governmental request, or when necessary to protect the rights, property, or safety of VectraGuard, our users, or others.
4.3 Business Transfers
In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you of any such change and any choices you may have regarding your information.
4.4 What We Never Do
We do not sell your personal data to third parties. We do not share your scan results or vulnerability findings with anyone outside your organization without your explicit authorization. We do not use your security data for advertising purposes.
5. Data Retention
We retain your account information for as long as your account is active or as needed to provide you with our Services. Scan results and security reports are retained for the retention period of your plan.
An organization owner can permanently delete the organization and its associated data from the platform (self-serve erasure), which removes that data right away. If an account is terminated instead, you can export your data within 30 days, after which we will delete it. In either case, we may keep information that we are required to retain for legal or regulatory purposes. Anonymized and aggregated data that cannot identify you may be retained to improve our Services.
6. Data Security
We implement technical, administrative, and organizational security measures to protect your information, including:
- Encryption of data in transit (TLS) and application-level AES-256-GCM encryption of stored credentials and MFA secrets
- Tenant isolation enforced in the database with PostgreSQL row-level security
- Role-based access controls, with TOTP multi-factor authentication that can be enforced across an organization
- Audit logging of platform activity
While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We encourage you to use strong passwords and enable multi-factor authentication on your account.
7. Your Rights & Choices
7.1 Access & Portability
You have the right to request a copy of your personal data in a structured, commonly used format. Organization owners and admins can export the organization data directly from the platform.
7.2 Correction & Deletion
You may update or correct your account information through your account settings. An organization owner can delete the organization and all associated data from the platform. You may also request deletion of your personal data by contacting us, subject to any legal retention requirements.
7.3 Opt-Out
You can unsubscribe from marketing emails at any time. You can manage cookies and locally stored data through your browser settings. You may request that we stop processing your data for certain purposes.
7.4 Restriction & Objection
Where applicable under local law (such as the GDPR or CCPA/CPRA), you have the right to restrict or object to the processing of your personal data, and the right not to be subject to automated decision-making.
8. International Data Transfers
Your information may be transferred to and processed in countries other than your country of residence. Where we transfer personal data internationally, we rely on the safeguards that applicable law requires, such as Standard Contractual Clauses approved by the European Commission.
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, the rights described in section 7 apply to you under the GDPR. If you are a California resident, you may have additional rights under the CCPA/CPRA, including the right to know and delete personal information.
9. Cookies & Local Storage
Our website does not set cookies of its own and runs no analytics, advertising, or tracking scripts. The only third-party code it loads is Cloudflare Turnstile, and only on the Contact page. According to Cloudflare, Turnstile relies on cookies and local storage to keep its state, so it may store small items in your browser while the bot check runs. We do not turn on Turnstile's optional pre-clearance mode, which would add a clearance cookie. The VectraGuard platform uses authentication cookies to keep you signed in. In summary:
- Website: no cookies of our own and no analytics or advertising trackers
- Theme preference (light or dark): kept in your browser's local storage, not in a cookie, and never sent to us
- Contact page only: Cloudflare Turnstile may use cookies or local storage set by Cloudflare, used to detect bots
- Platform: authentication cookies, used only to keep you signed in and to protect your session
You can clear or block cookies and local storage through your browser settings. Blocking the platform authentication cookies prevents you from signing in, and blocking Turnstile may prevent the contact form from sending (you can email us instead). See our Cookie Policy for details.
10. Children's Privacy
Our Services are not directed at individuals under the age of 16. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal data, please contact us and we will take steps to delete such information.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The "Last updated" date at the top of this page shows when it last changed. We will notify you of material changes by posting the updated policy on our website and, where appropriate, by email. Your continued use of the Services after the effective date of the revised policy constitutes your acceptance of the changes.
12. Contact Us
If you have questions about this Privacy Policy, wish to exercise your data rights, or have a privacy concern, please contact us at:
We aim to respond to all privacy-related inquiries within 30 days.