Privacy Policy
What VibeSIEM Scan collects, what remains local, and how stored data is handled.
1. Scope
This policy describes processing by [LEGAL_OPERATOR_NAME] for the VibeSIEM Scan website, cloud coordination service, and paired local runner. It does not govern a target you scan, your VPN or proxy provider, Microsoft, npm, your hosting provider, or another third party.
2. Local data
The runner is designed to keep credentials, authorization headers, session cookies, raw repositories, arbitrary local files, full authenticated response bodies, and detailed raw evidence on your device. Local HTML, JSON, and SECURITY_FIXES.md reports remain under your control. Uninstalling the runner does not necessarily delete reports you saved.
3. Cloud data we may collect
- Microsoft account name, email, provider identifier, and avatar information.
- Login-attempt, interest-request, paired-device, authorization, and security audit metadata.
- Target hostname, verified-control status, scan identifier, selected scope, timing, status, runner and ruleset versions, and completion reasons.
- Normalized findings, redacted evidence, accepted-risk state, and rescan history that you choose to synchronize.
- Operational data such as request timing, error state, IP address, user agent, and abuse-prevention signals.
4. Data we do not intend to store in the cloud
We do not intend to store target passwords, session cookies, authorization headers, private keys, full repositories, unrestricted response bodies, or unnecessary query values. The runner must show what will be synchronized before optional cloud upload. If you discover that prohibited data was uploaded, contact [SECURITY_CONTACT_EMAIL].
5. Network and egress information
The runner displays the public egress IP it observes before a scan and detects changes during execution. The full source IP remains local by default. The cloud may receive a coarse network-path label such as direct, VPN, or proxy, plus ordinary web-server connection logs. Future collection of a scan-source IP requires clear disclosure before upload.
6. How we use data
We use data to authenticate users, pair and revoke runners, issue declarative scan plans, present reports, compare rescans, prevent abuse, troubleshoot failures, maintain security, respond to requests, meet legal duties, and evaluate whether the product is useful. Automated analysis may format or clarify findings, but deterministic evidence controls finding state and severity.
7. Legal bases and consent
Depending on location, processing may rely on performance of a contract, legitimate interests in operating and securing the service, consent for optional synchronization or communications, and compliance with legal obligations. Jurisdiction-specific disclosures and rights must be completed after launch markets are selected.
8. Service providers and disclosures
We may use Microsoft for authentication, hosting and infrastructure providers, package distribution services, and vendors that help operate or secure the service. They receive only data reasonably needed for their role. We may disclose data when legally required, to protect rights or safety, during a business transaction subject to appropriate safeguards, or with your direction. We do not sell personal information.
9. Retention and deletion
No-account scans remain local. During the free beta, cloud reports are intended to expire after 30 days unless a shorter period is shown. Account, security, authorization, and abuse records may be retained longer when reasonably necessary. Users must be able to delete a scan immediately. Backup deletion can take additional time. Exact schedules must be operationally verified before this policy is approved.
10. Security
We use administrative, technical, and physical safeguards appropriate to the service, including data minimization, access controls, transport encryption, redaction, and operational separation. No safeguard makes a system completely secure. Report suspected issues through the Security & Abuse Policy.
11. Your choices and rights
You may decline cloud synchronization and still use supported local reporting. You may revoke paired runners, delete scans, and request access, correction, export, or deletion of eligible account data by contacting [LEGAL_CONTACT_EMAIL]. Rights differ by jurisdiction, and identity verification may be required.
12. Children and international processing
The service is not directed to children under 18. Data may be processed in the United States or another location used by our providers. Transfer disclosures and mechanisms must be finalized before offering the service in jurisdictions that require them.
13. Changes and contact
Material changes will be posted with a new effective date and, when appropriate, additional notice. Privacy questions: [LEGAL_CONTACT_EMAIL]. Security incidents: [SECURITY_CONTACT_EMAIL].