Privacy policy

• Account details: your name, email address, password (stored only as a salted hash), two-step sign-in settings, and the organisations you belong to.
• Sites and scans: the addresses you add, how you verified them, scan results, evidence (with secrets masked) and fix reports.
• Test accounts for deep scans: the labels, roles and secrets you give us. Secrets are encrypted at rest and never shown again.
• Billing: your purchase history. Card details go directly to Stripe; we never see or store them.
• Usage and security logs: sign-in times, IP addresses, browser type and an audit log of changes, used to keep accounts secure.

To run scans and show your reports, to send the emails you ask for (verification, invitations, scan alerts), to keep accounts and the service secure, to process payments, to answer support requests, and to meet our legal obligations. We don't sell personal information, and we don't use it for advertising.

Only service providers that help us run Hardn, under contracts that require them to protect it:

• Amazon Web Services: the scanning servers (US East, N. Virginia) and the API (Sydney, Australia).
• Supabase (Sydney): the database.
• Vercel: hosting for this website and the app's web pages.
• Resend: sending email.
• Anthropic: writing fix reports. We send the finding and its masked evidence, never your test-account secrets, and use Anthropic's commercial API, which doesn't train on your data.
• Stripe: payments.

Some of these providers may process data outside Australia (for example in the United States). We choose providers with strong security and contractual protections.

We keep your account and reports while your organisation is active. When you delete a site or an organisation, we delete its data from the live database, except records we must keep by law (such as payment records) and backups that expire on their normal cycle.

Data is encrypted in transit, secrets are encrypted at rest, access is limited to people who need it, and sign-ins support two-step verification.

You can access and correct most of your information in the app. You can ask us for a copy of the personal information we hold about you, ask us to correct or delete it, or complain about how we've handled it, by emailing us. If you're not satisfied with our response, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

The app uses a sign-in cookie and a few cookies needed for security and to remember your organisation. We don't use advertising cookies.

Privacy questions: support@hardn.si. Infonex Pty Ltd trading as Hardn, ABN 93 632 080 427, Australia.