Privacy

This service is built to collect as little data as technically possible. No accounts, no third-party analytics or trackers of any kind, and no cookies at all unless you verify domain ownership (see below).

What we process, and why

• Owner-verification cookie: set only if you complete domain ownership verification (DNS TXT record or well-known file). It's a random, unguessable token, scoped to that one domain, HttpOnly (not readable by any script) and never sent to third parties. Its sole purpose: proving to us on later visits that you are the person who verified this specific domain, so only you (not anyone who happens to find the domain's result on the public leaderboard) see its full report. No tracking or analytics use. Expires after 365 days, matching the verification itself; only our own database ever stores the (hashed) counterpart used to check it.
• Scan target (the domain you submit): processed in memory and in a short-lived Redis cache while the scan runs (deleted automatically after 1 hour). The finished result (target plus the full report: grades, findings, fix guidance, but never the underlying tool output, see below) is additionally stored indefinitely in our database, so a repeated scan of the same target can reuse the existing result instead of scanning again ("cache"). You can always force a fresh scan instead of the cached one.
• Public leaderboard: the target and its grade may appear on/leaderboard(Recently seen / Recent best / Recent worst), unless you tick "Do not publish this result on the leaderboard" when starting the scan. That checkbox also removes the result from search-engine indexing (the report page is marked noindex). You can change this preference at any time by scanning the same target again with a different checkbox state.
• Requesting IP address: used for rate limiting (in-memory counter, expires after 10 minutes) and logged together with the scan target and a timestamp for up to30 days, solely to investigate abuse reports (e.g. if this service is used to scan infrastructure without authorization). This log is not used for any other purpose, and is never stored in the database described above.
• Proof-of-control tokens (if you verify domain ownership for a full port scan and full report access): the one-time proof token itself lives in Redis for 30 minutes and is then deleted automatically. Once verified, that status is stored in our database for365 days (not 24 hours as in an earlier version of this service), and a fresh owner-verification cookie (see above) is issued so you don't have to re-verify a domain you already proved you control, as long as you use the same browser.
• Cookie notice acknowledgement: when you dismiss the small cookie notice shown on your first visit (see the bottom of every page), that choice is remembered in your browser's localStorage (not a cookie), so the notice doesn't reappear on every page. It is never sent to us or to any third party, and you can reopen the notice at any time via "Cookie settings" in the footer.

We never store the raw output of the underlying scanning tools (testssl.sh, ssh-audit, nmap, …), only the processed findings/grades that are actually shown to you.

Email delivery test (/mailtest)

The mail delivery test works differently from the domain scan: instead of a target you type in, we generate a random, single-use email address and wait for you to send a real message to it from the mailbox you want to test.

• The generated address and job status live only in our short-lived Redis cache for up to 15 minutes (the address works once, then expires), then are deleted automatically. This is never written to the database described above and never appears on the public leaderboard.
• Your test message is fetched from our mailbox, parsed in memory (headers, authentication results, spam-filter score, content structure), and then deleted immediately from the mailbox once processed. A safety sweep additionally purges anything left in that mailbox older than 24 hours, in case a message is ever missed. We never keep a copy of your message.
• The raw headers of your own test message are shown back to you as part of the result (similar to mail-tester.com). Unlike a domain scan's raw tool output, this is your own message and only reachable via the private, single-use result link for that test. It disappears together with the rest of the job data after the 15-minute window described above.
• No account or domain-ownership proof is required or possible for this feature. The random, unguessable address is the only access control, and results are never public.

Like the domain scan, requests to generate a test address are rate-limited per IP address (see above). We don't keep a separate 30-day abuse log for this feature, since a test address never targets third-party infrastructure, only the mailbox you choose to send from.

Legal basis

Processing is based on legitimate interest (Art. 6(1)(f) GDPR) in operating the service securely, preventing abuse of the scanning infrastructure, and, for the cache and public leaderboard described above, in avoiding unnecessary repeated scans against third-party infrastructure and in providing a public overview of scan results in the spirit of transparency (opt-out available at any time).

Persistent storage & deletion

Unlike an earlier version of this service, scan results and domain verification status are now kept in a database rather than only in a short-lived Redis cache (see above for what exactly is stored and for how long). Want a specific result deleted, or have questions about what's stored for a given target? Contact us via the imprint or theabuse contact and we'll remove it.

Server logs

The underlying web server / reverse proxy may keep standard technical access logs (IP, request, timestamp, user agent) for operational and security purposes for a limited time, like any web server.

Questions about this policy? See the imprint for contact details.