Privacy Policy
1. Who we are
Colin Finley, doing business as Frontage Security (“Frontage,” “we” or “us”) operates Frontage, an external attack surface monitoring service for businesses. For privacy questions and requests, contact privacy@frontagesecurity.com.
2. What this policy covers, and our two roles
We decide how and why some personal data is used (we are its “controller”): data about people who visit our website, request an account, use the service, pay for it, sign an authorization to scan, contact us or report a security issue to us. This policy describes that data.
We process scan data for our customers (we are their “processor” or “service provider”): the results of assessing a customer’s systems can incidentally contain personal data, such as a name or email address in a DNS record, a certificate or a server banner. We handle that data only on our customer’s instructions, under our Terms of Service. See section 6.
3. What we collect and where it comes from
Account data, from you: your email address; your password, stored only as a salted hash; your role and organization; whether you use two-factor authentication, with the secret that generates your codes (stored encrypted) and hashes of your recovery codes; and your display preferences.
Account request details, from you: your name, job title and phone number; your organization’s name, website, size, industry and address; your connection to the organization; and, if you choose, how you heard about us and a note. We also record the IP address and browser version of the request and automated review flags (for example, that the email address is not at the organization’s domain).
Authorization records, from you and the people who sign for your organization: the name, title and contact details of each person who signs an authorization to scan, the targets and dates authorized, how control of each target was verified and, for a verification by email, the address that confirmed it and the IP address it was confirmed from. If you ask us to send a confirmation link or DNS record instructions to someone, we use that email address only to send that message, and keep it in our audit log.
Billing data, from Stripe: you give your card and billing details to Stripe directly, on Stripe’s page, and we never receive or store your card number. Stripe tells us a customer reference, whether a payment succeeded and the subscription’s status and renewal date.
Free domain check: the domain you enter, the results, the account request it was run for and the IP address it came from (to limit use and prevent abuse).
Security and usage records, generated by our systems: an audit log of security-relevant actions (such as sign-ins and failed sign-ins, scan requests and refusals, changes to authorizations, account changes, registrations and checkouts), each with the account, time, action, target, outcome and IP address; and short-term web server logs with IP addresses, times, requested addresses and browser details. Cloudflare, which delivers our website, also processes request data such as IP addresses (see section 7).
Communications: messages you send us, the service emails we send you and reports you send to our security address.
4. How we use it, and our legal bases
- To provide the service: create and secure accounts, run checks, produce findings and reports, send alerts and service emails and take payment. (Performance of our contract with you or your organization.)
- To verify authorization to scan and prevent abuse: confirm that the person requesting an account represents the organization, that each target is authorized and controlled by the customer and that the service is not used to assess other people’s systems; and keep an accountable record of what was authorized and run. (Our legitimate interests in operating lawfully and safely, and legal obligations.)
- To protect the service: detect and respond to attacks, limit repeated sign-in failures and investigate misuse. (Legitimate interests.)
- To communicate with you about your account, the service and changes to these documents. (Contract and legitimate interests.)
- To meet legal obligations, such as tax records, and to establish or defend legal claims.
We do not send marketing email, and we do not use personal data for advertising or to train artificial intelligence models.
5. We do not sell or share personal data
We do not sell personal data, and we do not share it for cross-context behavioral advertising. We use no analytics, advertising or tracking services.
6. Scan data we process for customers
When we assess a customer’s systems, the results may incidentally include personal data. We use that data only to provide the service to that customer, keep it confidential and separate from other customers’ data, and delete it as our Terms of Service describe. Where a check finds an exposed file that may contain credentials or other secrets, we do not store the file’s contents; we record only that it was readable, with at most a short excerpt in which secret values are redacted. If you are an individual whose information appears in a customer’s results, please contact that customer; we will help them respond to you.
7. Who receives personal data
We use a small number of service providers, each of which receives only what it needs to do its job. They are listed, with what each does and where, on our subprocessors page, which we update before adding a new one. In summary:
- Cloudflare delivers our website and handles our domain’s DNS and email: it processes web traffic in transit (including IP addresses and request contents, since encrypted connections end at Cloudflare’s network), and carries the emails we send and receive.
- Stripe processes payments.
- Google hosts the inbox where mail to our addresses is delivered.
- Slack carries internal notifications to our staff, such as a new account request (name, email, organization, website and review flags, but not phone number or address) and billing events.
- Amazon Web Services runs the server our active scans come from, and the encrypted queues that carry scan requests and results between it and our application. It receives the domain names and addresses being scanned and the results in transit; the scanning server stores none of it.
- crt.sh, a public certificate log search service operated by Sectigo, receives a customer’s domain name when we search certificate logs for it.
We also share data where you direct us (for example, alerts and reports emailed to the people your organization chooses, and alerts posted to a Slack, Microsoft Teams or webhook address your organization chooses; the finding titles, severities and target in those messages leave our systems for that service); with professional advisors bound to confidentiality; with a complaining system owner or an authority where needed to show that testing was authorized (see our Terms of Service, section 10); where the law requires it; and with a successor if our business is transferred, subject to this policy.
8. Cookies, Do Not Track and Global Privacy Control
We use one cookie, named __Host-session. It is signed so that it cannot be altered, can be read only by us and not by scripts on the page and is sent only over encrypted connections. It is set when you open the sign-in or registration page and when you sign in, to protect forms against forgery and to keep you signed in, for up to 12 hours or until you sign out. It is strictly necessary for those functions. The landing page does not set it. We use no other cookies.
Because we do not track visitors across websites or use advertising or analytics, there is no tracking for a Do Not Track or Global Privacy Control signal to switch off. We treat those signals as an opt-out of any sale or sharing, which we do not do in any case.
9. How long we keep it
| Data | How long |
|---|---|
| Free domain check results | Results are deleted after 30 days; the IP address is cleared from the related audit entries at the same time |
| Account request details | While the account exists; deleted with the account, including when a request is declined |
| Account data | While the account exists; deleted on request |
| Scan data and findings | During the subscription; read-only for 30 days after it ends, and deleted within 90 days of the end, or sooner on request |
| Authorization records and the audit log | Seven years after the last scan, as evidence that testing was authorized |
| Billing records | As long as tax law requires |
| Backups | Replaced on a 14-day cycle, so deleted data can remain in a backup until then |
| Web server logs | Short-term, rotated automatically by size |
| Correspondence | As long as needed to deal with it, and then for up to three years |
10. Security
We protect personal data with measures appropriate to a security service, including encryption of connections to the service; passwords stored only as salted hashes; two-factor authentication available on every account, with its secrets encrypted at rest; separation of each customer’s data, enforced by the application on the server; administrative functions that cannot be reached from the public internet; an audit log of security-relevant actions; and not storing the contents of exposed files our checks find. No system is perfectly secure, and we cannot guarantee that data will never be accessed without authority.
11. If there is a breach
If we discover a breach of security affecting personal data we hold, we will investigate it, take steps to contain it and notify affected people, customers and authorities as the law requires, including under Pennsylvania’s Breach of Personal Information Notification Act. Where we hold data for a customer, we will notify that customer without undue delay, and within 72 hours of confirming the breach.
12. Where data is processed
We are based in the United States, and our servers are in the United States. Some of our providers, such as Cloudflare, operate globally, so data may be processed in other countries. We do not currently offer the service to organizations in the United Kingdom, the European Economic Area or Switzerland.
13. Your rights and choices
You may ask us for a copy of the personal data we hold about you, to correct it or to delete it. You may also object to a use of it or ask us to restrict it. Depending on where you live, you may have further rights, such as to receive your data in a portable form or to appeal a decision we make about a request. To make a request, email privacy@frontagesecurity.com. We will verify your identity before acting, respond within 30 days and not treat you differently for exercising your rights. If we hold the data for a customer (section 6), we will refer your request to that customer and help them respond.
California residents: this policy describes the categories of personal data we collect, where it comes from, how we use it and who receives it. We do not sell or share personal data. You may use the rights above, and an authorized agent may make a request for you with your written permission.
14. Children
The service is for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18.
15. Changes to this policy
We may update this policy. The effective date above shows the current version. We will notify account holders of material changes by email at least 30 days before they take effect.
16. Contact
Questions and requests about this policy: privacy@frontagesecurity.com. General inquiries: contact@frontagesecurity.com.
Colin Finley, doing business as Frontage Security · contact@frontagesecurity.com