Draft for legal review
Who operates the service
ScnFix Pentest is the managed web and API assessment service. It is separate from any mobile application scanner that may be offered under a related name. [Owner to confirm: registered legal name, postal address, and a privacy contact email.]
What you can submit
The request form collects the name of a contact, a business email, company name, company website, industry, application name, application URL, API type, an optional endpoint count, how users sign in, the number of roles, the environment, a target date, the reason for the request, an optional compliance note, optional technical details, and an optional API specification file.
The form refuses passwords, API keys, bearer tokens, and private keys when they appear in free text. Do not send secrets by email.
Account and project records
An account stores a name, email, password hash, organisation, and, after enrolment, an encrypted authenticator secret. Recovery codes are stored only as hashes. After an engagement exists, the record can include scope, quotation, rules of engagement, status notes, evidence files, findings, and reports.
Access to a customer project is limited to that organisation, assigned researchers, and staff reviewers. Evidence files are not published on open URLs. A session cookie named scnfix_pentest_session is used to keep you signed in. In production it is Secure, HttpOnly, and SameSite=Lax, and it expires after 12 hours. The site does not use a marketing cookie.
When mail delivery is configured, messages are status notes for requests, quotations, engagement updates, and researcher invitations. They do not include passwords, invite tokens, evidence, or reproduction steps. Until a mail provider is configured, those notes are stored and not sent. A failed delivery is recorded as failed and is not described as sent.
Where the current testing deployment stores data
The protected testing deployment stores the database and evidence files in Google Cloud, region asia-south1. [Owner to confirm: whether any other subprocessors, regions, or transfer terms apply before public launch.] This draft does not claim a transfer mechanism or a certification.
Retention
No retention period is set on this page. [Owner to confirm a retention period, and what is deleted when an engagement ends, before this notice is final.] You can ask, through the request form, to see or delete a project record. What can be deleted depends on copies already downloaded and on any record of an authorised test that must be kept. This draft states no statutory deadline.
What this service does not do
The product has no feature that sells personal information. It is built for organisations requesting a security assessment. It is not designed as a service for children. This draft does not state a lawful basis, a data-protection role, or a guarantee about regulatory compliance.
Changes
This draft will change after legal review. The date of that review is not yet set. [Owner to confirm: how customers will be told about a final notice.]