1. Controller
The controller responsible for data processing is:
2. Data We Collect
2.1 Account Data
When you register, we collect:
- Email address
- Hashed password (bcrypt, never stored in plain text)
- Company name (optional)
- Selected plan and billing information (processed by Stripe)
2.2 Scan Data
When you run a compliance scan, we process:
- Cloud account identifier (AWS Account ID or Azure Subscription ID)
- Cloud resource configuration metadata (read-only, no content data)
- Compliance check results (pass/fail status per check)
- Scan timestamps and compliance scores
We do NOT collect: the contents of S3 objects, database records, secrets, access keys, or any user data stored in your cloud resources. We only read infrastructure configuration metadata.
2.3 Usage Data
We collect minimal usage data:
- IP address (for rate limiting and security, not tracked)
- Browser user-agent (for compatibility)
- Pages visited and feature usage (no third-party analytics)
2.4 Cookies
We use only strictly necessary cookies:
- Authentication token — stored in localStorage, required for the application to function
- Cookie consent — remembers your cookie preference
- Language preference — remembers your language selection
We do not use tracking cookies, advertising cookies, or third-party analytics (no Google Analytics, no Facebook Pixel, no Hotjar).
3. Legal Basis (GDPR Art. 6)
- Contract performance (Art. 6(1)(b)): Processing account and scan data to provide the Service
- Legitimate interest (Art. 6(1)(f)): Security measures, fraud prevention, service improvement
- Consent (Art. 6(1)(a)): Marketing emails (opt-in only)
- Legal obligation (Art. 6(1)(c)): Tax and accounting records
4. Data Storage and Security
All data is stored on servers operated by Netcup GmbH in Karlsruhe, Germany. We implement the following security measures:
- AES-256 encryption at rest for all database data
- TLS 1.3 encryption for all data in transit
- Passwords hashed with bcrypt (cost factor 12)
- API keys hashed before storage
- Regular security updates and patching
5. Subprocessors
We use the following subprocessors:
| Provider | Purpose | Location |
|---|---|---|
| Netcup GmbH | Server hosting | Germany |
| Cloudflare | DNS resolution (no proxy) | EU |
| Stripe | Payment processing | EU (Ireland) |
| Poste.io (self-hosted) | Transactional email | Germany (our server) |
No US-based subprocessors. Your data never leaves the European Union.
6. Data Retention
- Account data: Retained until account deletion
- Scan results: Retained until account deletion or manual deletion by user
- Server logs: Automatically deleted after 30 days
- Billing data: Retained for 10 years as required by German tax law (§ 147 AO)
Upon account deletion, all personal data and scan results are permanently erased within 24 hours, except where retention is legally required.
7. Your Rights (GDPR Art. 15–22)
You have the right to:
- Access (Art. 15): Request a copy of all personal data we hold about you
- Rectification (Art. 16): Correct inaccurate personal data
- Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten")
- Data portability (Art. 20): Export your data in a machine-readable format (JSON)
- Restriction (Art. 18): Restrict processing of your data
- Objection (Art. 21): Object to processing based on legitimate interest
- Withdraw consent (Art. 7): Withdraw previously given consent at any time
To exercise these rights, contact us at [email protected]. We will respond within 30 days.
8. Right to Complain
You have the right to lodge a complaint with a supervisory authority. The competent supervisory authority is: Die Landesbeauftragte für den Datenschutz und die Informationsfreiheit des zuständigen Bundeslandes.
9. Data Processing Agreement
If you process personal data using ConformScan on behalf of third parties (e.g., scanning client cloud accounts as a managed service provider), a Data Processing Agreement (DPA) pursuant to GDPR Article 28 is required. Our standard DPA is available at /dpa.
10. Changes
We may update this Privacy Policy from time to time. We will notify registered users via email of material changes at least 14 days before they take effect.
Datenschutzerklärung
1. Verantwortlicher
Verantwortlich für die Datenverarbeitung ist: ConformScan, Soukeina Hane, 2 Place de Port au Prince, 75013 Paris, France. E-Mail: [email protected]
2. Erhobene Daten
Bei der Registrierung erheben wir: E-Mail-Adresse, gehashtes Passwort (nie im Klartext gespeichert), optional Firmenname. Bei Scans verarbeiten wir: Cloud-Account-ID, Konfigurationsmetadaten (nur lesend), Prüfergebnisse (bestanden/nicht bestanden), Scan-Zeitstempel.
Wir erheben NICHT: Inhalte von S3-Objekten, Datenbankeinträge, Secrets, Zugriffsschlüssel oder Nutzerdaten in Ihren Cloud-Ressourcen.
3. Rechtsgrundlage (DSGVO Art. 6)
Vertragserfüllung (Art. 6(1)(b)), berechtigtes Interesse (Art. 6(1)(f)), Einwilligung (Art. 6(1)(a)) für Marketing-E-Mails, gesetzliche Pflicht (Art. 6(1)(c)) für Steuerunterlagen.
4. Speicherung und Sicherheit
Alle Daten werden auf Servern der Netcup GmbH in Karlsruhe, Deutschland gespeichert. Verschlüsselung: AES-256 at rest, TLS 1.3 in transit. Passwörter mit bcrypt gehasht. Keine US-Unterauftragsverarbeiter.
5. Aufbewahrung
Kontodaten bis zur Löschung. Scan-Ergebnisse bis zur Löschung. Server-Logs nach 30 Tagen gelöscht. Abrechnungsdaten 10 Jahre (§ 147 AO).
6. Ihre Rechte
Sie haben das Recht auf Auskunft (Art. 15), Berichtigung (Art. 16), Löschung (Art. 17), Datenübertragbarkeit (Art. 20), Einschränkung (Art. 18), Widerspruch (Art. 21) und Widerruf der Einwilligung (Art. 7). Kontakt: [email protected]
7. Beschwerderecht
Sie haben das Recht, sich bei einer Datenschutz-Aufsichtsbehörde zu beschweren.
8. Cookies
Wir verwenden ausschließlich technisch notwendige Cookies (Authentifizierung, Spracheinstellung, Cookie-Zustimmung). Keine Tracking-Cookies, kein Google Analytics, kein Facebook Pixel.