Privacy Policy

Vranox LLC (“Vranox,” “we,” “us,” or “our”) operates a tech-maturity-assessment platform that allows authorised organisations (“Customers”) — including technology resellers, managed service providers and companies assessing themselves — to generate structured tech maturity assessments of their own organisation and, where enabled, of their prospects and clients (together, “End Companies”).

This Privacy Policy describes how we collect, use, share, and protect personal and business information when you use the platform or submit a request through the forms on vranox.com.

Account information

• Name, email address, and role for each user authorised by your Customer organisation.
• Authentication data (password hash, login timestamps) — handled by our authentication provider, Supabase.
• Display preference (theme).

Customer-provided assessment data

• Prospect / End Company names, technology stacks, custom products, and any other information your authorised users enter into an assessment, including assessment options such as framework, scope and report language.
• Documents your users upload as assessment evidence (for example penetration-test reports), stored in our file storage.
• Your workspace logo, if you upload one.
• AI-generated assessment outputs (for example findings, framework coverage, gaps, risks, scores, optional recommendations and tabletop exercises, and the cited sources behind them).
• Workspace records you create or that the platform produces for you: product estate / inventory, risk alerts, reassessment schedules, comments, and activity logs (who did what, when).

You and your Customer organisation are the controller of the prospect / End Company data you enter. You are responsible for having a lawful basis to process it and for any obligations owed to those End Companies under applicable law.

Collector data (where enabled)

• Where the Vranox Collector desktop app is enabled for your workspace, it reads configuration information from systems your users choose to connect and uploads configuration facts used in your assessments.
• Credentials entered into the Collector stay on the machine running it and are not sent to us. The machine is identified by an opaque fingerprint (not its hostname), plus an optional label your user types, the app version and the operating-system platform.
• Where enabled for your workspace, our servers may check the public DNS, TLS-certificate and web-header configuration of a domain your users enter, and may read configuration from AWS, Azure or Google Cloud accounts your users connect. The results are stored with your assessment.
• If your users connect a cloud service by authorisation (OAuth), the resulting access tokens are stored on our servers encrypted at the application level (AES-256-GCM).

License and request data

• Your workspace's license record: tier, term, activation and expiry dates, seat counts, and an encrypted copy of the license key.
• Requests your workspace admin sends us from within the platform (renewal, upgrade or data export): the admin's verified account email, a reply-to address they type, and an optional note.
• Messages you send us from within Vranox: seat requests, ‘Contact Vranox’ messages, and feedback flagging a claim in a report, including the text you enter and your account and workspace identifiers.
• Feedback your admin gives on a risk alert (for example “doesn't apply to us”), which is sent to Vranox.

Quote requests

• If you use the “Get a quote” form on vranox.com, we receive the name, email address, company, company size, role, frameworks, message and tier interest you enter, and the date. We do not verify these details. They are stored in our internal request inbox and emailed to Vranox through our email provider. We use your IP address and a one-way hash of your email address only for a short time, to limit repeated submissions. We do not store them. Quote requests are kept for up to 24 months and then deleted.

Inferred and technical data

• IP address, browser type, device type — collected via standard server and network logs.
• Usage records, such as AI usage per workspace, used for rate limiting, cost control and abuse prevention.
• Cookies and similar browser storage, described in section 9.

• To provide the platform: authenticate users, render assessments, generate PDF / PPTX deliverables, persist your work between sessions.
• To send assessment inputs to our AI provider (see “Subprocessors” below) so it can produce the assessment. These inputs include the technology stack, your assessment options, custom products you describe, documents you upload as evidence, and Collector configuration facts used for re-assessments. Uploaded documents are sent in full, including any personal or business information they contain.
• To research the products in a technology stack. Product names — not your company name or End Company names — are researched using our AI provider's web search and web fetch tools and public sources such as the U.S. National Vulnerability Database, the CISA Known Exploited Vulnerabilities catalog and endoflife.date. The resulting general product information (for example vendor, versions, end-of-life dates and published advisories, with their sources) is stored in a shared product library that we reuse for all Customers. The library is designed to hold information about products, not information that identifies your organisation or your End Companies. We also record, per workspace, which products it asked about.
• To send email you or your workspace need: invitations, password resets, assessment updates, digests and framework-change notices; risk alerts that need action, sent to workspace admins; and license notices to workspace admins, such as reminders 30 and 7 days before expiry and a notice on expiry that explains the data-export period.
• To respond to quote requests and to workspace requests for renewal, upgrade or data export.
• To improve security and reliability: monitor for abuse, rate-limit requests, debug errors, audit access.
• To understand how the platform is used and to turn features on or off, using pseudonymous product analytics and feature flags.
• To communicate operational matters: account changes, security incidents, service updates.

We do not use Customer-provided assessment data to train AI models. Under Anthropic's commercial terms, Anthropic does not use our API inputs or outputs to train its models.

Access by Vranox

Vranox operates the platform and can view, export and delete workspaces, and erase user accounts left without a workspace, for support, account administration and deletion requests. Exports we make of your workspace are recorded in your workspace's activity log.

We rely on the following third parties to deliver the platform. Each processes data under its own data-processing terms:

We will notify your Customer organisation in advance of any addition or replacement of a subprocessor, allowing reasonable time to object before the change takes effect.

Our subprocessors are located in the United States and, for some providers, the European Union; Cloudflare operates a global network. If you or your prospects are located elsewhere, your information may be transferred to, stored in, and processed in those locations. Where required, transfers of personal data from the European Economic Area, United Kingdom, or other jurisdictions with similar requirements rely on the safeguards in our providers' data-processing terms, such as standard contractual clauses.

• Account information: retained while the account is active. When a workspace is deleted, user accounts that do not belong to another workspace are erased.
• Customer-provided assessment data: retained until your Customer organisation deletes it or asks us to delete it, or until we delete the workspace. Deleting a workspace deletes its data, including uploaded evidence files. We do not delete it automatically on a schedule.
• After a license expires or is revoked, the workspace is kept read-only until it is deleted. For at least 30 days after that point, and for as long as the workspace remains read-only, your admin may request a data export; after those 30 days we may delete the workspace, but nothing is deleted automatically.
• Quote requests: kept for up to 24 months and then deleted, or deleted earlier on request.
• Workspace requests: contact details on them are erased when the workspace is deleted or on an erasure request.
• Server logs: retained for up to 12 months.
• Activity / audit logs: retained for the life of the workspace and deleted with it.
• Shared product library: general product information (section 3) is kept and reused independently of any workspace.

Deleted data may persist for a limited period in our providers' systems (for example logs) before it is overwritten.

Workspace admins can request an export of the workspace's data (credentials, keys and internal operational records are excluded) from within the platform, including while the workspace is read-only. Once we grant it, the admin downloads it while signed in, within seven days; the email we send never contains a download link. On request, your Customer organisation can also ask us to delete or export specific assessment data. See “Your rights” below.

• Encryption in transit (TLS 1.2+) for all platform connections.
• Encryption at rest for the database (Supabase-managed AES-256).
• Signed-in users have no direct access to database tables, except read-only, permission-checked access to comments so they update live: every other request goes through our application, which scopes each query to the user's own workspace, and row-level security (RLS) on every database table adds a second layer.
• Application-level encryption (AES-256-GCM) for stored connection tokens and license keys. Revealing a license key requires re-entering the admin's password, is rate-limited and is logged.
• Role-based access controls within each workspace (Admin / User). Users see only the assessments they create; admins see the whole workspace.
• Logged access trails for sensitive operations.
• Closed user registration — Vranox sets up each workspace and its admin, and the admin invites Users within the workspace's seats.

No system is perfectly secure. If we become aware of a security incident affecting your data, we will notify the affected Customer organisation without undue delay.

Depending on where you are located, you may have rights to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your data (subject to operational and legal limits).
• Export your data in a portable format.
• Restrict or object to certain processing.
• Withdraw consent (where processing is based on consent).
• Lodge a complaint with your local data-protection authority.

To exercise any of these rights, contact us at inquiries@vranox.com. We will respond within 30 days.

We use cookies and similar browser storage (local storage) for:

• Session authentication (Supabase sign-in cookies).
• Saved interface preferences, such as theme and sidebar state, and the inactivity sign-out timer.
• Your cookie choice (the vranox_consent cookie, kept for 180 days), so we do not ask again on every visit.
• Pseudonymous product analytics (PostHog), only if you choose “Accept analytics” in the cookie banner. Until you accept, the PostHog code is not loaded in your browser: your browser sends nothing to PostHog and nothing is stored in your browser for it. If you accept, it uses a pseudonymous user ID and your workspace identifier — never your name or email address — and PostHog also receives your IP address (and approximate location derived from it), browser and device details, and the addresses of the pages you visit, with sign-in, password-reset and invitation tokens removed. We do not record sessions, heatmaps or performance data.

The first three are strictly necessary and are always on. Whatever you choose, our servers (not your browser) also talk to PostHog: to decide which features are switched on, they send it your pseudonymous user ID and your workspace identifier, and they send a few workspace-level counts (for example, that an invitation was accepted in a workspace) with no user identifier. Nothing is stored in your browser for either. Rejecting analytics is as easy as accepting it, and you can change your choice at any time with Cookie settings (also at the bottom of the sign-in page and in the dashboard sidebar). Rejecting sends nothing to PostHog. If you withdraw consent, analytics stops at once, nothing more is sent, and its cookies and browser storage are removed.

We do not use advertising cookies or social-media cookies, and we do not sell or share data for advertising.

The platform is not directed to anyone under 16 and we do not knowingly collect personal data from children.

We may update this policy from time to time. Material changes will be notified to your Customer organisation in advance. Non-material clarifications take effect when posted, with a revised “Last updated” date.

For privacy questions, data-rights requests, or concerns:

Vranox LLC
inquiries@vranox.com