🔒 Security & Compliance
Your security is our priority. Learn how we protect your data and help you stay compliant.
🛡️ Data Security
Encryption Everywhere
All data transmitted between your servers and our platform uses TLS 1.3 encryption. Data at rest is encrypted using AES-256.
Access Control
Multi-factor authentication, role-based access control, and secure password hashing with bcrypt ensure only authorized access.
Intrusion Detection
24/7 monitoring, automated threat detection, and real-time alerts protect our infrastructure from attacks.
Regular Audits
We conduct regular security audits, penetration testing, and vulnerability assessments to maintain our security posture.
Automated Backups
Daily encrypted backups with geographic redundancy ensure your data is never lost.
Secure Infrastructure
Hosted on enterprise-grade infrastructure with DDoS protection, firewall rules, and network segmentation.
🎯 What Data We Collect
What We DO Collect
- Email address and account credentials
- Server names (as you define them)
- List of installed packages (names and versions only)
- Operating system type and version
- Scan timestamps and results
What We DON'T Collect
- Application source code
- Configuration files or environment variables
- Database contents or credentials
- File contents or directory structures
- Network traffic or communication logs
- Any personally identifiable information from your servers
📋 Compliance Standards
GDPR Compliant
We comply with the General Data Protection Regulation for users in the European Economic Area. You have the right to access, correct, delete, and export your data.
CCPA Compliant
California residents have additional rights under the California Consumer Privacy Act, including the right to know what data we collect and opt-out of data sale (we don't sell data).
SOC 2 Type II
We follow SOC 2 Type II standards for security, availability, processing integrity, confidentiality, and privacy.
ISO 27001
Our information security management system follows ISO 27001 best practices for data security and privacy.
🔍 Agentless Security
Unlike traditional security tools that require persistent agents on your servers, FixTheCVE is completely agentless:
🚨 Incident Response
In the unlikely event of a security incident:
- We will notify affected users within 72 hours
- Detailed incident reports will be provided
- We'll work with security experts to resolve the issue
- Post-incident reviews and security improvements will be implemented
- Regulatory bodies will be notified as required by law
📞 Security Contact
Found a security vulnerability? We take security seriously and appreciate responsible disclosure.
Security Email: security@fixthecve.com
PGP Key: Available upon request
Please do not publicly disclose security issues until we've had a chance to address them. We typically respond within 24 hours and aim to resolve critical issues within 7 days.
🔒 Your Data, Your Control
You have complete control over your data. You can:
- Access and download all your data anytime
- Delete your account and all associated data
- Control who has access to your scan results
- Opt-out of email notifications
- Request data corrections or updates