Privacy policy and terms of use

Who we are and what this covers

Securelyn runs the Securelyn website at securelyn.com, Securelyn Intel at intel.securelyn.com and Securelyn Scan at scan.securelyn.com. This one policy covers all three. It explains what we collect, why, who sees it and your choices, and it sets the terms for using them.

Questions, requests to see, correct or delete your details, and requests to remove or correct an organisation named on Securelyn Intel: email [email protected].

What we collect

You can read the website, the advisories and the CVE and data pages without an account and without giving us any details. We collect details only when you use a form or run a scan.

• Website forms: your name, email, company, phone, team size, service interest and message, the page you came from, when you sent it and the wording you agreed to.
• Securelyn Intel digest: your email address, the wording you agreed to, when you agreed and when you confirmed. We keep the address encrypted.
• Securelyn Intel requests to get in touch: your email, and your name and organisation if you give them, the advisory you asked about and the wording you agreed to.
• Securelyn Scan: the domain you scanned, the time, the grade, the score and the full result. If you tick the deeper check we also record that you confirmed you are authorised to scan the domain, and when.
• Securelyn Scan report requests: your email, and your name and company if you give them, with the domain, the report ID, the page you came from, the time and the wording you agreed to.
• A salted one-way fingerprint of your network address, used only to limit abuse. We do not store the address itself.
• Page view counts from a cookie-free analytics service.
• Securelyn staff accounts: the work email address and sign-in records of our own staff.

Why we collect it and how we use it

To reply to you, to send the digest or report you asked for, to provide services you ask about, and to protect our forms and scanner from abuse. We do not sell your details and we do not use them for anything else without asking you first.

Email from us

Every email from us comes from an address at securelyn.com. We ask you to confirm your address before we send the digest, and if you do not confirm within three days we remove the sign-up. Every digest has an unsubscribe link that works with one click and takes effect straight away. You can also write to [email protected].

How long we keep it

• Securelyn Scan results are kept for 30 days and then deleted.
• Digest subscriptions are kept until you unsubscribe. An unconfirmed sign-up is removed after three days.
• Other details are kept only as long as we need them to answer you and to provide what you asked for. You can ask us to delete them sooner.

Other services we use

Cloudflare hosts our sites, runs Cloudflare Turnstile to tell people from automated traffic, and provides Cloudflare Web Analytics, which does not use cookies. Email is sent through Zoho ZeptoMail. These services process data to do that job and have their own privacy policies.

For the deeper Securelyn Scan check, the domain name is sent to an independent TLS assessment service and an independent website security scan, which then contact the domain themselves. For the standard check we send only the domain or its public addresses to public databases.

The Securelyn Scan password-leak check never sees your password. Your browser turns it into a one-way SHA-1 fingerprint and sends only the first five characters to the Have I Been Pwned service through us. The match is made on your own device and nothing is stored. The password strength check runs entirely in your browser.

How Securelyn Scan identifies itself, and how to opt out

A scan makes DNS lookups, looks things up in public records and makes one normal visit to the home page. It also makes one request to http:// to test the redirect and one to /.well-known/security.txt. This is the same traffic a browser sends. The optional deeper check adds GET requests only, to a short fixed list of common file locations and a few public pages, and it respects robots.txt.

Our scanner sends this User-Agent: SecurelynScanner/1.0 (+https://scan.securelyn.com/privacy)

If you own a domain and do not want it scanned, email [email protected] with the domain name, or add a DNS TXT record with the value securelyn-scan=deny on the domain. We check for the record in both the standard and the deeper check, and we then refuse scans of that domain and its subdomains.

Report links use a long random ID and are not indexed by search engines. Anyone with the link can view the report, so share it with care. The full report is shown only through a private link we email to you after you give your email and consent.

Public information on Securelyn Intel

Securelyn Intel explains software security problems in plain English. It is general information, not advice for your situation. Always check the vendor’s own advisory before you act. Each advisory shows the date its data was current, and facts change, so something may be out of date. Summaries a Securelyn engineer has not reviewed yet are labelled.

Its figures come from public sources: the CISA Known Exploited Vulnerabilities catalogue, the NIST National Vulnerability Database (NVD), FIRST EPSS, OSV, the ransomware.live public aggregator, and the Have I Been Pwned breach catalogue, which is used under the Creative Commons Attribution 4.0 licence with credit to Have I Been Pwned. This product uses data from the NVD API but is not endorsed or certified by the NVD.

Some pages name organisations. A ransomware claim is a claim, not proof: the organisations listed were named by criminal groups on the groups’ own sites, and a claim is not proof that an attack happened, that data was taken or that the organisation is at fault. Securelyn has not checked these claims and shows names as the public aggregator published them. We never visit leak sites and we show no leaked content, claim links or screenshots.

Reported breaches come from the Have I Been Pwned catalogue, which lists breaches it has checked. The details are as Have I Been Pwned published them and Securelyn has not checked them.

To ask for an organisation to be removed or a detail to be corrected, email [email protected]. The check-if-you-are-exposed link goes to Securelyn Scan, which looks at public signals only: a clear result does not prove you are safe.

Terms of use

• You may read and share our public content. Do not try to break, overload or gain unauthorised access to our sites, and do not scan a domain you do not own or have permission to scan.
• Content on our sites is general information. It is not advice for your situation. Use our services for advice that fits your systems.
• Securelyn Scan checks public information only. Results are a guide, not proof that a system is or is not vulnerable.
• Paid services start only after we agree scope and sign a written agreement. We do not test systems you do not own or have permission to test.
• We link to the CISA, NVD, vendor and other pages. We do not control them and are not responsible for their content.

Your choices

You can ask to see, correct or delete your details by emailing [email protected]. To stop the digest, use the unsubscribe link in any email. To stop scans of a domain you own, see the opt-out above.

Changes

We will update this page when our practices change.