1. Scope & Commitment
At VAPT Portal, our primary mission is protecting our clients' attack surface. We recognize that conducting security audits, penetration testing, and code reviews grants us privileged access to sensitive telemetry, system architectures, and vulnerability findings.
This Privacy Policy governs how we collect, handle, isolate, and cryptographically purge data collected during your use of our platform and penetration testing engagements.
2. Information We Collect
We delineate collected data into two distinct categories:
- Account & Administrative Data: Names, corporate email addresses, billing coordinates, and audit point-of-contact details provided upon onboarding.
- Assessment Telemetry: Target hostnames, IP ranges, API endpoints, vulnerability logs, raw HTTP response traces, and simulated proof-of-concept exploits generated strictly during authorized test windows.
3. Security Audit Data Isolation (No AI Training)
We enforce strict cryptographic tenant isolation. Your source code, API keys, database fragments, or vulnerability advisories:
4. Cryptographic Shredding & Retention Schedule
We do not retain vulnerability proofs or target telemetry indefinitely. Upon delivery of the final re-test verification certificate:
- Raw packet captures and offensive tools logs are permanently overwritten within 14 calendar days.
- Audit evidence repositories are cryptographically shredded within 30 calendar days following customer sign-off.
- Executive compliance summaries are preserved in cold KMS-encrypted vaults according to your specified regulatory compliance mandate (default: 1 year).
5. Infrastructure Subprocessors
All platform services are hosted in enterprise SOC 2 Type II certified cloud data centers within the United States or the European Union (per client data residency preferences):
| Subprocessor | Function | Location |
|---|---|---|
| Amazon Web Services (AWS) | Encrypted Cloud Hosting & KMS Key Storage | US-East / EU-Central |
| Stripe | PCI-DSS Level 1 Payment Processing | Global |
6. Your Rights Under GDPR & CCPA
Depending on your jurisdiction, you retain statutory rights to inspect, export, restrict processing, or demand immediate cryptographic erasure of personal and organization data. Requests will be executed within 3 business days of verified identity check.
7. Contacting the Data Protection Officer (DPO)
For any queries regarding this policy, data residency preferences, or cryptographic purge certificates, contact our Data Protection Team: