Who we are
This policy explains how Secure Raven handles personal data on secureraven.app, in the Secure Raven dashboard, through Customer API v1 and in the emails we send. Secure Raven is the security layer of the Olyron framework, and is built by Olyron.
The company responsible for your personal data, the controller, is Legal entity name · owner to confirm. You can reach it at privacy@secureraven.app.
What we collect
Only what the service needs. Each item says where it comes from.
- Account
- Your email address, your role and the organization you belong to. Your password and authenticator-app factor are held by our authentication provider, Supabase. MFA recovery codes are stored only as keyed hashes.From you or the admin who invites you, or from your Olyron account if you sign in with Olyron
- Early access requests
- Your work email, your company and what you run (Supabase, Postgres or public websites), plus your name and a note if you add them. To limit abuse we keep a keyed hash of your network (the first part of your IP address), never the address itself.From the early access form
- Your systems
- The systems and websites you add, the host names of your data sources, findings (titles, severity, table and policy names, flags), scan history, and the events your probe sends. Only allowlisted event types are accepted. We never store the rows in your database.From the dashboard, your API calls and the probe you install
- Keys and credentials
- For each API key, a SHA-256 hash of its token and its Ed25519 public key, never the private key. If you store a database credential, it is sealed with AES-256-GCM envelope encryption bound to your organization and source, and only an isolated broker service can decrypt it. Storing database credentials is off in production today.From you, when you mint a key or connect a source
- Audit log
- Each privileged action: what was done, when, your user ID, and keyed hashes of your network address and browser. It never stores a raw IP address, and it drops any value that looks like an email address, a token or a password.Written by Secure Raven when you act
- Your email address. Invitations, password resets and security notices go to it, and so do the alerts you turn on, which carry a severity, a short title and a link to the dashboard.Sent through Resend
- Sign-in protection
- To slow password guessing, the sign-in pages count requests from each IP address in server memory for one minute. The count is not stored.From your browser’s requests
- Request data
- Our hosting and authentication providers process request data, such as your IP address and browser type, to deliver the service and keep it secure.From every visit
- Messages to us
- If you write to us, your message and your address, so we can answer.From your email
What we never do
- By designWe do not sell or rent personal data, and we do not share it for advertising.
- By designWe use no analytics, advertising or tracking cookies. Our public pages load no third-party scripts, fonts or images.
- By designWe do not train AI models on your data. No AI model reads your data, and findings, events and credentials are never sent to an AI vendor.
- By designWe do not store the rows in your database. We keep table names, policy names and flags.
- By designIn push-probe mode, we do not hold your database password.
How we use it
- To run the service: inspections, findings, scan history, Watch, and the alerts you turn on.
- To keep it secure: MFA and step-up checks, rate limits, and the audit log.
- To answer you: early access requests, support and privacy requests, and vulnerability reports.
- To send service email: invitations, password resets, security notices and the alerts you turn on. We send no marketing email.
Service providers
These companies process data for us. None of them is an AI vendor.
- Supabase
- Our database, authentication, edge functions and storage. Requests to Supabase pass through Cloudflare, Supabase’s own provider.
- Vercel
- Hosts this site and the dashboard.
- Resend
- Sends our email.
- Olyron
- Sign-in, if you choose Sign in with Olyron.
- GitHub
- Hosts our source code. It receives no customer data.
The current list is on our Trust page. These providers process data in the United States and in other countries where they operate.
How long we keep it
- Events90 days after they occur
- Inspection runs1 year after they finish
- Resolved findings2 years after they are resolved or the risk is accepted
- Audit logKept. Append-only, and we do not delete it
- A daily job deletes events, finished inspection runs and resolved findings when their time is up.
- Open findings are kept while they are open.
- Account data is kept while your account is active. When you ask, we delete it, except entries in the audit log.
- Early access requests are deleted a year after they arrive, or sooner if you ask.
- The audit log is append-only, and we do not delete it. Its entries hold user IDs and keyed hashes, not email addresses or raw IP addresses.
How we protect it
- TLS 1.2 or later and HSTS in transit. AES-256 encryption at rest on our providers’ disks.
- Row-level security on every table that holds customer data, with tests that check one organization cannot read another’s rows.
- MFA with an authenticator app, and a fresh 5-minute step-up before privileged actions.
- API and probe requests signed with Ed25519. We store only public keys.
- An append-only, hash-chained audit log of privileged actions.
No system is perfectly secure. If you find a problem, see how to report a vulnerability.
Your rights
Depending on where you live, you can ask to see, correct, delete or get a copy of your personal data, and to object to or limit how we use it. Email privacy@secureraven.app. We answer within 30 days, and we may first need to confirm it is you. If your organization’s admin manages your account, we may ask them to act.
If you are in the European Economic Area or the United Kingdom, you can also complain to your local data protection authority.
Children
Secure Raven is a tool for businesses. It is not meant for children under 16, and we do not knowingly collect their data. If you think a child has given us personal data, write to privacy@secureraven.app and we will delete it.
Changes to this policy
When this policy changes, we update the date at the top. If a change affects how we use your data, we will tell account holders by email before it takes effect.
Contact
- Privacy
- privacy@secureraven.app
- Security reports
- security@secureraven.app. See how to report a vulnerability.
- Controller
- Legal entity name · owner to confirm
- Postal address
- Postal address · owner to confirm