Privacy Policy

1. Introduction

Performant Ventures Ltd ("we", "our", or "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use PerimAssure (the "Service"), a sub-product of Performant Ventures Ltd.

2. Information We Collect

We collect information that you provide directly to us, as well as data generated automatically through your use of the Service.

2.1 Information You Provide

• Account Information: Name, email address, and authentication credentials.
• Asset Information: Domain names, IP addresses, and URLs you submit for scanning.
• Verification Data: DNS records or file tokens used to prove ownership of assets.
• Payment Information: Processed securely by our third-party payment processor (Stripe). We do not store full credit card details.

2.2 Information Generated by the Service

• Scan Results: Vulnerability findings, security posture grades, and evidence bundles (which may include HTTP responses, headers, and snippets of publicly accessible code or data from your assets).
• Usage Data: Log data, browser types, and interaction metrics with our dashboard. For anonymous free scans, network addresses are immediately converted to a keyed pseudonymous value; the raw address is not stored in the scan record.

3. How We Use Your Information

We use the collected information for the following purposes:

• To provide, maintain, and improve the Service (e.g., executing security scans and generating reports).
• To verify your ownership of target assets before performing active testing.
• To process transactions and send related information, including confirmations and invoices.
• To send technical notices, security alerts, and support messages.
• To train and improve our proprietary AI scanning models (using anonymized and aggregated scan data only).

4. Data Security and Retention

We implement appropriate technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction. Security findings and evidence bundles are encrypted at rest.

We retain your account information and scan history for as long as your account is active. If you delete your account, we will securely delete or anonymize your data, except where retention is required by law or for legitimate business purposes (e.g., resolving disputes or enforcing our agreements).

Anonymous free-scan assets, results and evidence are retained for no more than 30 days so the temporary result link can function and abuse can be investigated. Pseudonymous rate-limit metadata is retained for no more than 2 days. These limits do not apply to signed-in customer scan history, which is governed by the account terms above.

5. Sharing of Information

We do not sell your personal data. We may share your information in the following circumstances:

• Service Providers: With third-party vendors who perform services on our behalf (e.g., payment processing, cloud hosting, email delivery).
• Legal Requirements: If required to do so by law or in response to valid requests by public authorities.
• Business Transfers: In connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business.

6. Public Badges and Verification

If you choose to display a PerimAssure security badge on your website, the verification status of that specific asset will be publicly accessible via our verification endpoint. This public information is limited to the asset name, the tier of scanning, and the current validity status of the badge. Specific vulnerability findings are never made public.

7. Your Rights

Depending on your location (e.g., under the GDPR or CCPA), you may have certain rights regarding your personal data, including the right to access, correct, or delete your data. To exercise these rights, please contact us.

8. Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us at privacy@perimassure.com.