LEGAL
Privacy Policy
This policy explains how we process personal data when you visit swarmhawk.com, use the client area at app.swarmhawk.com and use our security testing services, in line with the EU General Data Protection Regulation (GDPR, in particular Articles 13 and 14) and Czech Act No. 110/2019 Coll.
1. Controller
Swarmhawk s.r.o., Company ID (IČO) 29644861, registered office Příčná 1892/4, Nové Město, 110 00 Praha 1, Czech Republic, entered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 449938. Contact: admin@swarmhawk.com.
Privacy requests are handled directly by Swarmhawk s.r.o.; please send any privacy request to the address above.
2. What we process, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Account data: email address, password hash (argon2; we never store your password), account status, your plan (PRO or Enterprise, billing period and test schedule), acceptance of the Terms (each version you accepted and when) and confirmation that you have read this policy (each version you confirmed and, where recorded, when) | Create and run your account, log you in, contact you about the Service | Art. 6(1)(b) contract | While the account exists; after closure deleted or anonymised on request to admin@swarmhawk.com within 30 days, unless the law requires us to keep it longer; if you register but never confirm your email address, your account and its registration data are deleted automatically, usually within 8 days after your last registration attempt or the last confirmation email we sent you; accounts that are disabled or that own a domain, scan, credit or subscription are not deleted this way (registration events in the security audit log are kept for 180 days with a pseudonymised identifier of your email address and your shortened IP address, as described below) |
| Two-factor authentication data, if you turn it on: your authenticator secret (stored encrypted with AES-256-GCM), keyed hashes (HMAC-SHA256 with a server-side secret key) of your recovery codes and whether each was used (recovery codes issued before this change stay stored as unkeyed SHA-256 hashes: using one only marks it as used, it is not re-hashed or deleted; they are deleted when you generate new codes, turn two-factor authentication off or your account is deleted), and short-lived login challenge records with your network address shortened to /24 (IPv4) or /48 (IPv6) | Protect your account with a second login factor | Art. 6(1)(b) contract; 6(1)(f) legitimate interest in account security | Secret and recovery code hashes while two-factor authentication is on (deleted when you turn it off or the account is deleted); login challenges expire after 5 minutes and are deleted |
| Penetration test credits: a ledger of credits granted, used, returned, revoked and expired, with time, reason, related test and plan period | Provide the plan you pay for; accounting and dispute handling | Art. 6(1)(b) contract; 6(1)(c) accounting law | The ledger is append-only and is kept after account closure for the periods required by Czech accounting and tax law (up to 10 years) |
| Domains you add, DNS verification tokens and results | Verify ownership before testing; prevent unauthorised testing | Art. 6(1)(b) contract; 6(1)(f) legitimate interest in preventing abuse | While the domain is in your account |
| Pre-screen results for domains you have added but not yet verified: the technologies and versions detected, where available identifiers of possible known vulnerabilities (CVE) for detected versions with, where available, whether each is flagged in our early-warning list as recently known to be exploited and, where that list has one, its exploit likelihood score, the date of the check, the HTTP status, the number of redirects and whether HTTPS or HTTP was used, for a valid TLS certificate its issuer, expiry date and up to 20 names it covers together with the TLS protocol version and cipher (for an invalid certificate only the type of error), a summary of the DNS checks (whether mail and CAA records exist) and, for domains that receive email, a summary of the SPF, DMARC, DKIM and DANE checks (whether a record was found, its policy setting, whether a DMARC reporting address is set but not the address, and which of the checked DKIM selectors were found); only this summary is stored, also in the shared copy described in the last column, not the DNS records themselves, the page content, its headers or cookies; if you asked for the optional exposed-files check (see section 2 of the Terms of Service), also, for each of the three checked addresses (/.git/HEAD, /.git/config and /.env), only the outcome (publicly reachable, not detected or could not check), the HTTP status and the time of the check, never the content or the headers of these responses; this part is not stored in the shared copy | Show you a passive overview of the domain before verification (contract); prevent misuse of this feature (legitimate interest) | Art. 6(1)(b) contract, for showing you the overview; 6(1)(f) legitimate interest, for preventing misuse of the pre-screen | Your pre-screen result: 7 days from when the data was retrieved from the domain; it is no longer shown after that and is deleted by our regular cleanup, normally within about a day; deleted earlier when the domain is removed from your account (only our administrators can do that), when your account is deleted (on request, see Deletion below) or when the domain owner asks us to delete it or opts out; the outcome of the optional exposed-files check is part of your pre-screen result and is kept and deleted with it; a shared copy of this summary, not linked to any account, is used for at most 24 hours from when the data was retrieved, so that the same domain is not fetched again for every request, and is deleted by our regular cleanup, normally within about a day after that; a record of each pre-screen you start (your account, the domain it was started for, a keyed code of the domain name, the day, the times it was requested, started and finished, its status and outcome, and whether a shared copy was used; when you ask for the optional exposed-files check, no shared copy is used) is kept, once the pre-screen has finished or failed, until 7 days after you started it and is then deleted by our regular cleanup, normally within about a day; a pre-screen that stops while running is marked as failed and then handled in the same way, and the record of a pre-screen that is still waiting to run is kept until it runs; these records are deleted earlier when the domain is removed from your account or your account is deleted, but not when the domain owner asks us to delete the result or opts out; may remain in encrypted backups as described below |
| Pre-screen opt-out requests: the registered domain name of a domain for which a person who says they own or control it has asked us never to pre-screen it (this covers its subdomains), and the date of that request as we record it | Honour the request and block pre-screens of that registered domain, including its subdomains, for every account | Art. 6(1)(f) legitimate interest in honouring the request and preventing pre-screens of that domain | For as long as the request applies; not deleted when the pre-screen results for the domain are deleted; may remain in encrypted backups as described below |
| Test jobs and reports (findings, evidence, scores); these may incidentally contain personal data found on the tested systems | Provide the Service | Art. 6(1)(b) contract | While the account exists; you can request deletion of reports at any time by writing to admin@swarmhawk.com; we handle requests within 30 days |
| Leaked-data findings for your domains (e.g. email addresses or credential exposure from public breach, paste and dark-web sources) | Show you exposure so you can remediate it | Art. 6(1)(f) legitimate interest (security of your organisation); as processor for you where applicable | As reports above; passwords are not displayed in clear text |
| Security and audit logs: IP address, login attempts (including attempts with email addresses that have no account), administrative actions, rate-limit events; the security audit log records each security event (logins and failed logins, two-factor authentication, registration, email verification, password resets and changes, test starts, pre-screens, domain verification, credit use, administrative actions) with your account and, instead of your email address, a pseudonymised identifier of it (a keyed hash, not the address itself), and your IP address shortened to its network (IPv4 /24, IPv6 /48); repeated rate-limited attempts from the same network are combined into one entry per hour with a count, the last network and only the identifier of the last email address used; for test starts, pre-screens and domain verification, the audit log entry identifies the domain concerned only by a pseudonymised reference (a keyed hash), not by its name (entries created before this change may still contain the domain name); for pre-screens it also records which version of the authorisation confirmation you gave and, if you asked for the optional exposed-files check, that you asked for it and which version of its separate authorisation confirmation you gave; for each such check that sent at least one request, one further entry records that it ran and that you gave that confirmation, with the site identified only by a pseudonymised reference (a keyed hash), but not what the check found; to apply most rate limits, the Service holds your IP address (for IPv6 only its /64 network) briefly in memory only (not written to disk), for up to about 3 hours after a locked sign-in; the in-memory record used to limit logging of blocked requests to administrative pages holds the same (IPv4 address, IPv6 /64 network), is no longer used about 60 seconds after the last logged request and is removed with the next blocked request or at the latest when the service restarts; the limits on requests to resend the confirmation email are instead stored in our database on disk, so that they also apply after a restart: for each request counted against these limits we store a keyed hash (HMAC-SHA256 with a server-side secret key, not the address itself) of your IP address (for IPv6 its /64 network) and of its wider network (IPv4 /24, IPv6 /48) for 1 hour, and a keyed hash of the email address concerned for 24 hours; after that these entries expire and are deleted, either the next time a confirmation email is requested or by our daily cleanup, so usually within a day after they expire, and like other database data they may remain in encrypted backups as described below; the limits on pre-screens are also stored in our database on disk in the same way: for each pre-screen counted against them we store a keyed hash (HMAC-SHA256 with a server-side secret key) of your account, of your network (IPv4 /24, IPv6 /48) and of the registered domain concerned for up to 24 hours; for the optional exposed-files check, also a keyed hash of your account for up to 24 hours, of the registered domain for up to 7 days, and of the web server's address and its network (IPv4 /24, IPv6 /64) for up to 24 hours; after that these entries expire and are deleted in the same way, usually within a day after they expire; administrative actions and these events on your own account: acceptance of the Terms, confirmation that you have read this policy, turning two-factor authentication on or off, generating new recovery codes, resetting your password by email, and changing the monitoring settings of your domains, are recorded in a separate administrative log with the person acting (an administrator, or you for these events on your own account), what the action concerns (e.g. the domain name), any other email address in the entry only as a pseudonymised identifier (a keyed hash, not the address itself), and the IP address of the person acting shortened to its network (IPv4 /24, IPv6 /48); for your acceptance of the Terms and your confirmation that you have read this policy, the log records you by your account and a pseudonymised identifier of your email address (a keyed hash, not the address itself) instead of the address (entries created before this change may still contain your email address); for the other actions of an administrator or of you, it records the email address of the person acting; command-line and system actions are recorded under their technical name; when unusually many sign-in or other security events for one account reach the audit log's per-account limit, where alerting is enabled, we may send an alert email to our own operations mailbox (hosted on Google Workspace) through Amazon SES (see section 4) with the account number and, where available, the pseudonymised identifier of its email address and the shortened network (IPv4 /24, IPv6 /48), plus the event type, the limit and the day, but no email address or full IP address | Secure the Service, detect abuse, investigate incidents | Art. 6(1)(f) legitimate interest; 6(1)(c) legal obligation where applicable | Server logs are rotated by size (up to 5 files of 10 MB per service; older entries are overwritten); the web server (Caddy) access log keeps client IP addresses only masked (IPv4 shortened to /24, IPv6 to /48) and also contains the request headers your browser sends (such as User-Agent and preferred language), with cookies, authorisation, the referring page (Referer) and client IP headers removed or masked, and the requested address with email addresses, tokens and similar values redacted; the access log of our public website (swarmhawk.com, nginx) records the full request line (including the requested address) and the referring page (Referer) without redaction, your browser's User-Agent and your IP address only masked (IPv4 shortened to /24, IPv6 to /48), and is rotated by size like the other server logs (up to 5 files of 10 MB); audit log 180 days, including login attempts for email addresses that have no account; audit log entries are kept for 180 days even after your account is closed; the 180 days are counted from an entry's last activity (repeated attempts combined into one entry keep it current), not from when it was first created; entries created before this change may still contain your full email address and full IP address until they are deleted at the end of that 180-day period; entries in the administrative log are kept for 180 days from when they were created; administrative log entries created before this change may still contain full email addresses and full IP addresses until they are deleted 180 days after they were created; these alert emails are deleted from the operations mailbox after at most 180 days; domain names in security audit log entries created before this change are kept for the same 180 days; entries for floods of rate-limited or unauthenticated attempts may be removed earlier when the audit log reaches its size limit; where this log is enabled, failed sign-in attempts are logged separately with the full IP address only (no email address or account); it is rotated daily and kept at most 14 days, to allow automatic blocking of attacking addresses |
| Emails we send you (verification, welcome, account notices) and delivery status | Account operation | Art. 6(1)(b) contract | Delivery metadata only as long as needed to operate and troubleshoot email delivery; in our server logs recipients appear only as a keyed hash tag, not as an email address (the security audit log stores the same kind of keyed identifier and only a shortened IP address; the separate administrative log stores the email address of the person acting (for your acceptance of the Terms and your confirmation that you have read this policy only the same kind of keyed identifier instead), other email addresses only as the same kind of keyed identifier, and only a shortened IP address, see above) |
| Billing data (company, billing contact, invoices) | Invoicing and accounting | Art. 6(1)(b) contract; 6(1)(c) accounting and tax law | For the periods required by Czech accounting and tax law (up to 10 years) |
| Messages you send us | Answer your request | Art. 6(1)(b) / 6(1)(f) | Up to 2 years after the matter is closed |
Providing account data is necessary to use the Service. We do not use your data for automated decision-making with legal or similarly significant effects, and we do not sell personal data.
Deletion: there is no self-service deletion; we handle deletion requests sent to admin@swarmhawk.com manually within 30 days. When we erase your account at your request, most of its data is deleted, with these exceptions. Entries in the security audit log (a pseudonymised identifier of your email address and your shortened IP address; older entries may contain your full email address and full IP address) are not erased: we keep them on the basis of our legitimate interest in investigating security incidents (Art. 6(1)(f) GDPR; erasure exception for the establishment, exercise or defence of legal claims, Art. 17(3)(e) GDPR) until their 180-day retention period ends, and then delete them. These entries name the domains of your test starts, pre-screens and domain verifications only by a pseudonymised reference (a keyed hash) that is unique per domain entry; your domains are deleted together with your account, so the entries no longer show which domains they concerned (see Backups). Entries created before this change may still contain these domain names until their 180-day retention period ends. Your pre-screen results are deleted together with your domains; the shared copy described in section 2 is not linked to your account, is no longer used 24 hours after the data was retrieved and is deleted by our regular cleanup, normally within about a day after that; pre-screen opt-out requests of domain owners are not linked to your account and are not deleted when your account or the pre-screen results are deleted. Records of administrative actions are kept without your email address, domain names or IP address (only your account number). Credit records stay in pseudonymised form (account number only; notes and names removed) for accounting and to prevent abuse (Art. 6(1)(c)/(f) GDPR). A disabled, empty account entry with your account number remains so that the number is never reused. Backups: backups of the database are encrypted, and we keep them for at most 12 months; older backups are deleted automatically. Offsite backup copies are write-protected for 90 days and are then removed automatically; under normal operation of the backup process, backups are removed within 12 months after they were made. Data deleted from the Service may remain in such backups for up to 12 months and, under normal operation of the backup process, disappears from them within 12 months after deletion. Backups and older log files are not edited to remove individual data; personal data in them is deleted when the backup or log file reaches the end of its retention period.
3. Cookies
We use only cookies that are strictly necessary for the client area: the session cookie sh_session, which keeps you logged in (expires after 24 hours, or after 60 minutes without activity, or when you log out); the anti-forgery (CSRF) cookie sh_precsrf, used on the login, registration and password-reset forms (until you close the browser, removed at login); sh_mfa, which links the two steps of a login with two-factor authentication (5 minutes, removed after the second step); sh_verify, which carries the email-verification token while you confirm your address (15 minutes, removed after verification); and sh_reset, which carries the password-reset token while you choose a new password (30 minutes, removed after the reset). In production these names carry the __Host- prefix. They are first-party, HttpOnly and Secure, and are not used for tracking. The public website swarmhawk.com sets no cookies and uses no analytics or third-party scripts. Because only strictly necessary cookies are used, no consent banner is required.
4. Recipients and processors
We share personal data only with service providers that process it on our behalf under data processing agreements (Art. 28 GDPR), or where required by law.
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services EMEA SARL (Amazon SES) | Sending transactional emails | EU (Frankfurt, region eu-central-1) |
| Google Ireland Ltd. (Google Workspace) | Our business email: operational alert emails and messages you send us (including requests about your rights) | EU; outside the EU/EEA only with the safeguards described in section 5 |
| Hetzner Online GmbH (Gunzenhausen, Germany) | Hosting of the website, client area, database and logs | EU (Finland) |
The scans and automated penetration tests you start run on our own SwarmHawk scanning platform, operated by Swarmhawk s.r.o.; it receives the domain to test and returns the results, and it is not a separate processor. Automated penetration testing may use AI model providers that process test data on our behalf; test data sent to them is limited to what is needed for the test, and where they process it outside the EU/EEA, the safeguards described in section 5 apply.
5. Transfers outside the EU/EEA
We aim to keep data in the EU/EEA. Where a provider or its sub-processors process data outside the EU/EEA, we rely on an adequacy decision (e.g. the EU-U.S. Data Privacy Framework for certified providers) or on the European Commission's Standard Contractual Clauses with supplementary measures. For our business email (Google Workspace, see section 4), Google Ireland Ltd. may transfer data to its parent company Google LLC in the USA, for example for support; this transfer relies on the safeguards described in this section. You can request a copy of the relevant safeguards.
6. Security
We protect data with encryption in transit (HTTPS/HSTS), password hashing (argon2), hashed one-time tokens, strict access control and isolation between customers, rate limiting, audit logging and least-privilege access for staff. No system is perfectly secure; we will notify you and the supervisory authority of a personal data breach where the law requires.
When you choose a password in the client area, we check it against known breaches using the Have I Been Pwned 'Pwned Passwords' service (Troy Hunt, via Cloudflare). Only the first 5 characters of the password's SHA-1 hash are sent, from our server; your password, its full hash, your IP address and account details never leave our systems. If the service cannot be reached in time, the password is accepted without this check. The result of the check is not stored; if a password change is refused, our audit log records only that the change failed, not why.
7. Your rights
You have the right to access your data, to rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interest (Articles 15–21 GDPR). Where processing is based on consent, you may withdraw it at any time. To exercise your rights, write to admin@swarmhawk.com; we will respond within one month. You may also lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz) or the authority in your EU country.
If you believe leaked-data findings shown to one of our customers concern you personally, contact us and we will help, including forwarding your request to the customer where they are the controller.
If you own a domain that one of our customers has added, the Service may have made the limited requests described in section 2 of our Terms of Service (DNS lookups of the domain and of the hosts it redirects to, and lookups of the TLSA records of up to three of its mail servers, one request for the home page (/) plus at most two redirects within the same registered domain, and its TLS connection, and, only if the customer asked for the optional exposed-files check, up to 4 further ordinary web requests for /.git/HEAD, /.git/config, /.env and one random address that does not exist, of which only the outcome, HTTP status and time of the check are kept, never the content) and shown a summary of the result to that customer for up to 7 days from when the data was retrieved from the domain. You can object to this, complain about it or ask us to delete the result by writing to admin@swarmhawk.com. You can also ask us, at the same address, never to pre-screen your domain again. We do not verify that you own the domain: an email from you saying that you own or control it is enough. We then keep the registered domain name (this covers its subdomains) and the date of your request, as we record it, on a list so that we can honour it. Recording the opt-out also deletes the stored pre-screen results and shared copies for that domain; the administrative log notes it as described for security and audit logs in section 2. This entry is not deleted when the pre-screen results for your domain are deleted. Your email itself is kept as described for messages you send us in section 2 (up to 2 years after the matter is closed).
8. Children
The Service is for businesses and is not directed at children under 16.
9. Changes
We may update this policy; the version and date at the top show the current text. We will notify account holders of material changes by email or in the client area and ask you to confirm in the client area that you have read the new version.