Privacy Policy

Account information: your email address, an optional name, and how you sign in (a password, which we store only as a one-way hash; passkeys, stored as public keys; an authenticator-app setting and backup codes, stored encrypted; and, if you choose Google or Microsoft, that account's identifier), together with the devices and approximate network addresses of your signed-in sessions, all kept in our own database; any additional email addresses you choose to link and verify; your watchlist terms, digest preference and saved settings; the software, operating systems and devices you list under “Your infrastructure” (product names and versions, which we match against published CVEs and use for nothing else); billing status through our payment processor, Stripe (we never receive or store your full payment card number); and, for included access, the email address and subscription status reported to us by ExamPrep or HealthData DueCare. If you are a HealthData DueCare site administrator, DueCare also sends us your organization's program profile (entity type, standards, control status, top risks, and its system inventory with product names, versions and device operating systems, but no patient data, people or evidence) so we can tailor your view and match CVEs to your systems; we send the matching CVEs back to DueCare for your organization. When you create an account we record how you first reached the site (the referring website, any campaign tags in the link, such as utm parameters or a Google Ads click, and the page you landed on). We also keep aggregate, cookieless page-view and page-speed statistics and standard server logs for security and troubleshooting. While you are signed in, we record when you sign in, how long each visit lasts and which pages of the site you open, linked to your account, so we can see which features are used; this uses no cookies beyond your sign-in session. When you use Ask the data, we record the time of each question, its length in characters, and the number of AI tokens and data lookups used to answer it, to enforce the question limits and track cost. We do not store the text of your questions or of the answers; the conversation lives only in your browser tab. If you are a paying member and leave a rating on Rate Us, we store your rating, your review and the display name you choose; approved testimonials are shown publicly on our Testimonials page with the name you chose (or “Anonymous”), never your email address, and you can ask us to remove yours at any time. If you choose to answer them, we also keep the optional questions we ask at sign-up (your role) and at the end of your free trial (your reasons for subscribing or not, and any comment you add), linked to your account and used only to improve the Service. We also record each time you open a Stripe checkout page (the plan and whether the early-signup discount applied), whether or not you go on to pay, so we can see how the free trial converts.

The breach reports, regulatory documents, advisories and recalls we publish are federal agency records about organizations. We do not hold protected health information, and we do not collect information about individuals affected by a breach.

To operate your account, decide which features you are entitled to, send the alerts and digests you have asked for, process subscription payments, and communicate with you about your account. We also use it to understand which of our own marketing brings people to the Service. We do not sell your personal information, and we do not use it to target advertising at you. If you opt in to product news and offers in Settings, we may email you about new features and offers; this is off unless you turn it on, and every such email has an unsubscribe link. We keep a record of which of these emails were sent to you, and the links in them pass through our own site so we can count clicks and whether you went on to subscribe.

Google and Microsoft, only if you choose to sign in with them; Have I Been Pwned, which checks a new password against known data breaches without receiving the password (only the first five characters of its SHA-1 hash are sent); Stripe for billing, Vercel and Neon for hosting, database storage, aggregate page-view analytics and page-speed measurement, Microsoft 365 for sending email, Vercel AI Gateway and Anthropic to generate answers on Ask the data (the question you type and the public records retrieved to answer it are sent to them for that purpose, so do not include personal or confidential information in a question), and, only if you accept advertising cookies, Google Ads to measure whether our ads led to a sign-up or subscription. Each processes data on our behalf under its own privacy and security practices. Entitlement and profile messages from ExamPrep and HealthData DueCare, and the CVE findings we return to DueCare, travel over signed, private connections. To find vulnerabilities we download public data from the CVE Program, NIST's National Vulnerability Database, CISA and FIRST; nothing about you is sent to them.

We use essential cookies for authentication, session management and remembering your preferences, including your cookie choice, plus a first-party cookie recording how you first arrived at the site, which is copied to your account if you create one. With your consent, given through the banner shown on your first visit, we also load Google Ads, which sets an advertising cookie so we can measure whether our ads lead to sign-ups and subscriptions. If you reject it, the Google Ads tag is never loaded. You can change your choice at any time with “Cookie settings” in the footer.

Depending on where you live, including under the California Consumer Privacy Act, the Virginia Consumer Data Protection Act, or the EU/UK GDPR, you may have the right to access, correct, delete, or receive a copy of your personal information, or to object to certain processing. To exercise any of these rights, contact us using the details below.

We retain your account data for as long as your account is active, and for a reasonable period afterward to comply with legal and accounting obligations. Alert and digest send records are kept so we never send the same item twice. Ask the data usage records (time, question length and token counts, without the question text) are kept with your account data. You can request deletion of your account and associated data at any time.

We use industry-standard safeguards, including encrypted connections and access-controlled infrastructure, to protect your information. No system is completely secure, and we cannot guarantee absolute security.

This Service is intended for working professionals and is not directed to, or knowingly used by, children under 13.

We may update this Privacy Policy from time to time. Continued use of the Service after a change takes effect constitutes acceptance of the update.

For privacy questions or requests, contact rick@mtcgroupllc.com.