Privacy Policy.
What we collect, why, who we share it with, and exactly how test credentials and evidence from an authorized run are handled.
Who we are
SuperPentest provides autonomous, authorized penetration testing for web applications, APIs and the AI features inside them. For personal data processed through this website and through our own account and billing systems, SuperPentest is the controller. For personal data that happens to sit inside a customer's application while we test it under contract, the customer is the controller and SuperPentest is a processor — that relationship is governed by our Data Processing Agreement.
You can reach us about anything in this policy at [email protected]. Our contracting entity, registered details and the competent supervisory authority are stated in your order form and are available on request.
What this policy covers
This policy covers three things: the public website at superpentest.com, the demo booking flow, and the SuperPentest service itself (your account, your engagements, your reports). It does not cover third-party websites we link to.
What we collect
When you visit the website
- Technical and usage data — IP address, approximate location derived from it, browser and device type, pages viewed, referrer, and interaction events including anonymised session replays, collected through Microsoft Clarity.
- Security and delivery data — request logs and bot-protection signals processed by Cloudflare, which serves and protects the site.
When you book a demo
- Your name, work email address, timezone, chosen time, and anything you write in the booking notes. The scheduling itself runs on Cal.com.
When you become a customer
- Account data — name, work email, organisation, role, and authentication data for the people you invite.
- Engagement data — the scope you authorize, the targets you name, the rules of engagement you sign, schedules, and the findings, evidence and reports a run produces.
- Test identities — the credentials you deliberately provide so the engine can replay requests as each role. See Test credentials and evidence below.
- Billing data — plan, invoices and payment status. Card details are handled by our payment processor; we never see or store them.
- Support correspondence — email you send us and our replies.
We do not buy personal data, we do not run advertising trackers, and we do not sell or rent personal data to anyone.
Why we use it, and on what basis
| Purpose | Data | Legal basis |
|---|---|---|
| Running an engagement you authorized and delivering its report | Account, engagement, test identities | Performance of a contract |
| Scheduling and holding a demo | Booking data | Steps taken at your request before a contract |
| Billing, invoicing and collection | Billing data | Contract and legal obligation |
| Keeping the website and service secure and available | Technical, security logs | Legitimate interests in protecting our systems |
| Understanding how the site is used so we can improve it | Analytics and session replay | Consent where required, otherwise legitimate interests |
| Keeping an audit trail of who authorized what | Account, engagement, audit records | Legitimate interests and legal obligation |
| Answering support and sales email | Correspondence | Legitimate interests |
Where we rely on legitimate interests, we have weighed them against your rights and we explain the balance on request. Where we rely on consent, you can withdraw it at any time without affecting processing that already happened.
Test credentials and evidence
This is the part that matters most for a security product, so we state it plainly.
- Credentials are referenced, not exposed. The testing agent is given an identity label — "viewer in tenant A" — and the runtime attaches the credential. Credential values are not placed in model context, are not written into findings, and are not shown in the interface.
- Evidence is redacted before it is stored. Captured requests and responses pass through secret masking first. Tokens, cookies, keys and anything matching a secret pattern are replaced before anything is written to disk.
- A run can see customer data. Proving that one tenant can read another tenant's record necessarily touches that record. We capture the minimum needed to prove the finding, we redact it, and we recommend you use seeded test data rather than production records wherever your environment allows.
- Model reasoning stays private. Internal deliberation is not exposed to customers; the evidence, the control test and the replays are.
Who we share it with
We share personal data with service providers who process it on our instructions, under written terms, and only for the purposes above.
| Provider | What it does |
|---|---|
| Cloudflare | Website hosting, CDN, DNS and bot protection |
| Microsoft Clarity | Website analytics and session replay |
| Cal.com | Demo scheduling |
| MongoDB Atlas | Application database for accounts and engagements |
| Object storage (Cloudflare R2 / Amazon S3) | Evidence, artefacts and generated reports |
| Stripe | Payment processing and invoicing |
| Anthropic and OpenAI | Model inference for the testing engine, under zero-retention terms where offered |
We also disclose data where the law requires it, and we may transfer data as part of a merger or acquisition — in which case this policy continues to apply until you are told otherwise. The current list of sub-processors is kept here; customers under a DPA are notified before a new sub-processor starts processing their data.
International transfers
Some providers above process data outside the European Economic Area. Where that happens we rely on an adequacy decision where one exists, and otherwise on the European Commission's Standard Contractual Clauses together with the technical measures described in How we protect it. You can request a copy of the relevant safeguards.
How long we keep it
| Data | Retention |
|---|---|
| Website analytics | Up to 13 months |
| Demo booking records | 24 months from the booking, unless you become a customer |
| Account data | For the life of the account, then 90 days |
| Engagement evidence and reports | For the life of the account unless you ask us to delete earlier; auditors usually need these, so deletion is your call |
| Test credentials | Deleted when you remove the identity or close the account; we recommend you rotate them after an engagement |
| Billing records | As long as tax and accounting law requires, typically 7–10 years |
| Security and audit logs | 12 months |
Your rights
Subject to the conditions in applicable law, you can ask us to give you a copy of your personal data, correct it, delete it, restrict or object to how we use it, or provide it in a portable format. Where processing rests on consent, you can withdraw it.
Write to [email protected]. We answer within one month and will tell you if we need longer. We do not charge for this unless a request is manifestly unfounded or excessive. If a request concerns data inside a customer's application, we will refer you to that customer, who is the controller for it.
You also have the right to complain to your local data protection supervisory authority.
How we protect it
- Encryption in transit (TLS) and at rest for stored evidence, artefacts and database content.
- Secret redaction applied before evidence or logs are persisted.
- Role-based access, least privilege, and an append-only audit trail of who authorized and who accessed what.
- Isolated execution for every run, with network egress restricted to the authorized scope.
- Our own engine and platform are tested with the product itself, and reported issues follow the timelines on our security page.
No system is perfectly secure. If a breach affects your personal data and is likely to present a risk, we will notify you and the relevant authority within the time the law requires.
Cookies and analytics
The website uses a small number of cookies and similar identifiers. Strictly necessary ones keep the site working and protect it from automated abuse. Analytics identifiers, set by Microsoft Clarity, let us see which parts of the page people actually use, including anonymised session replay. Where consent is required in your jurisdiction, analytics only runs after you give it, and you can change your mind at any time by clearing site data in your browser or writing to us.
We honour browser-level opt-outs where the law gives them effect, and we run no advertising or cross-site tracking cookies at all.
Children
SuperPentest is a business product. It is not directed at children and we do not knowingly collect personal data from anyone under 16. If you believe we have, tell us and we will delete it.
Changes
When this policy changes we update the date at the top. If a change materially affects how we use your personal data, we will tell customers by email before it takes effect.
Contact
Questions, requests or complaints: [email protected].