Privacy policy

The data controller is VesperID SAS, whose registered office and identifiers appear in the legal notice.

For the data our clients entrust to us under their licence, monitored perimeter, users, individuals covered by a profile, VesperID acts as a processor within the meaning of Article 28 of the Regulation, on the documented instructions of the client acting as controller.

For data relating to our prospects, our users and the operation of our own services, VesperID acts as controller.

A data protection officer can be reached at dpo@vesperid.com for any question about the processing of your data or the exercise of your rights; the named appointment is in progress and will be published in the legal notice.

Requests may be made in French or in English.

Site visitors: no identifying data is collected for simple browsing. Technical logs (IP address, requested page, timestamp, user agent) are kept six months for security purposes, then deleted.

Prospects and contact requests: name, organisation, role, email address, optional phone number, message content, language, date and time of the request.

Platform users: name, work email address, role and scope within the organisation, language and notification preferences, authentication material (hashed password, second factors), sign-in logs and an audit log of actions.

Monitored perimeter and monitoring results: domain names, email addresses, identities of individuals monitored under executive protection, once the person has accepted the invitation, keywords, address ranges, code repositories, Microsoft 365 tenant identifier, bank identification numbers (BIN), and the associated exposure metadata (source, dates, hash type, presence and length of a cleartext password, indicators, counters; for a leaked card or bank account, the BIN, the last four digits, the brand, the expiry, the issuer, a masked IBAN and the bank, never the full number).

We never keep the value of a password, the hash supplied by the source, the value of a session cookie or a full card number. We keep metadata (the account concerned, the source, dates, hash type, the length of a cleartext password, counters) and, for mentions, a short, masked excerpt of the publication, a partial and unverified reproduction of a third party’s post. Secrets are discarded before any storage; occasional viewing happens live, without caching, and is subject to reinforced access control and logging.

Clients: billing details, contractual documents, invoices and payment history.

Answering contact requests and following up commercially: consent of the person writing to us and VesperID’s legitimate interest in handling enquiries received (Art. 6(1)(a) and 6(1)(f)).

Delivering the subscribed service, managing accounts, licences and support: performance of the contract with the client (Art. 6(1)(b)).

Monitoring the perimeter declared by a client and producing detections, alerts and reports: performance of the contract for the client, and the legitimate interest of the client acting as controller in protecting its organisation (Art. 6(1)(b) and 6(1)(f)); for a person’s protection profile, the person’s own acceptance of the invitation, which counts as consent and can be withdrawn at any time (Art. 6(1)(a)).

Invoicing, collecting payment and retaining accounting records: performance of the contract and legal obligation (Art. 6(1)(b) and 6(1)(c)).

Ensuring the security, availability and integrity of the platform, preventing abuse and logging access: VesperID’s legitimate interest (Art. 6(1)(f)).

Responding to rights requests and legal obligations: legal obligation (Art. 6(1)(c)).

Contact requests and prospects: two years from the last contact, then deletion; immediate anonymisation on request.

User accounts: for the contractual relationship; after an erasure, the pseudonymised record is deleted after three years, unless an accounting record refers to it.

Detections and monitored perimeter: during the licence, resolved or ignored detections are deleted after one year and open detections are kept; at the end of the licence, ninety days to allow export, then deletion, unless a different period is set in writing within a limit of twelve months.

Analyses (scores, cohorts, chains): a rolling ninety days for the exposed-accounts analysis, one year after the last recorded action, thirteen months for snapshots; all of it deleted with the licence’s detections.

Audit log: one year online then archived, three years in total; the IP address is deleted or hashed there after six months.

Technical logs (IP address, requested page, timestamp, user agent): six months for security purposes, then deletion.

Sessions and tokens: thirty days after expiry or revocation.

Generated reports: two years.

On-demand data exports: seven days, then automatic deletion.

Email delivery logs: ninety days; bounced or unsubscribed addresses: three years.

Notifications and alert delivery records: one year, then aggregated counts.

Search and reveal traces: one year for searches, thirteen months for reveals (invoicing), then a monthly aggregate without member identifier.

Takedown and investigation requests: five years after closure; evidence files: one year after closure.

Personal protection profiles: identities and detections deleted ninety days after the service ends; revoked access grants deleted after one year.

Invoices and accounting records: ten years after the end of the financial year, under statutory obligations.

Backups: thirty days; any deletion is therefore effective at the latest thirty days later.

Archived organisations and licences: five years after the end of the relationship, accounting records aside.

Your data is neither sold, rented nor passed to third parties for marketing purposes. It is accessible only to VesperID staff whose role requires it, within the limits of their authorisation. Members’ sensitive actions (reveal, export, status and role changes) and every support session of our staff are logged.

Scaleway SAS, 8 rue de la Ville l’Évêque, 75008 Paris (Paris region): servers, database, cache, object storage, encryption key management, secret manager, transactional email and image registry, for all data, within that region.

Our intelligence collection provider, established in Canada and designated here by its function: the collection space of every licence, matching of the declared identifiers, event feeds, live reading of a revealed secret, historical search. It receives the perimeter identifiers (domain names, addresses, keywords, address ranges, bank identification numbers, repositories, tenant identifiers, queries), the organisation’s name and sector (a technical identifier for an individual client) and, for a protected person who accepted the invitation, their first name, last name, addresses and aliases; the secrets it returns pass through without being kept. Transfer based on the European Commission’s adequacy decision 2002/2/EC, maintained by Article 45(9) of the GDPR, supplemented by the standard contractual clauses of Decision 2021/914 and by a transfer impact assessment. It has undertaken not to use the identifiers for its corpus, for other clients or for its own purposes, to delete them when the collection space ends, to notify any breach within twenty-four hours and to collect in compliance with the law applicable to it. Its identity is disclosed to our clients’ data protection officers on written request and under confidentiality.

Cloudflare, Inc., 101 Townsend Street, San Francisco (United States, global network of points of presence): DNS resolution, reverse proxy with TLS termination for vesperid.com, www, api, app and admin, caching, protection against denial-of-service attacks and the Turnstile anti-bot service. Traffic in transit, including authenticated sessions and revealed secrets, passes through its servers; Turnstile processes visitors’ IP addresses and browsing signals; no data is kept there beyond technical logs. Transfer based on Cloudflare’s certification under the EU-US Data Privacy Framework (Decision 2023/1795) and on the standard contractual clauses of its data processing agreement.

Functional Software, Inc. (Sentry), San Francisco (vendor established in the United States; ingestion and storage in the European Union): error reporting for the API, the workers, the client area and the console. Messages are scrubbed before sending (never an email address, a token, a cookie, an IP address or a username) and kept ninety days. Certification under the EU-US Data Privacy Framework and standard contractual clauses.

Google Ireland Limited, Dublin (Ireland), with processing by Google LLC (United States): mail for the contact@, dpo@ and security@ mailboxes, hence the correspondence about rights requests, reports and takedowns. Certification under the EU-US Data Privacy Framework and standard contractual clauses of the Google Workspace data processing addendum.

Have I Been Pwned (Pwned Passwords service, outside the European Union): when an account password is created or changed, VesperID checks that it does not appear in a list of compromised passwords. Only the first five hexadecimal characters of the SHA-1 hash of the candidate password are sent (k-anonymity range); neither the password nor any personal data leaves VesperID. No transfer instrument is required; the service is mentioned for transparency.

Not sub-processors of VesperID: the alert destinations the client configures (email addresses, Slack, Microsoft Teams, webhooks), which it chooses and answers for; the certificate authority issuing the TLS certificates; the host of the source code, which processes no client data.

Authorities: data may be disclosed to an administrative or judicial authority where the law requires it. We examine the validity of every request, challenge it where it is disproportionate, disclose only the minimum required and inform the person or client concerned where we are permitted to do so.

This list is kept up to date. An addition or a replacement is notified to clients thirty days before it takes effect, with the function, the location and the transfer instrument of the new sub-processor, and opens a right to object, in accordance with their data processing agreement.

Data stored and backed up at Scaleway SAS, in Paris. Traffic passes through Cloudflare’s network, intelligence collection relies on a provider established in Canada, error reporting is processed in the Union by an American vendor: the transfer instruments are described below, sub-processor by sub-processor.

The transfer to the collection provider concerns the identifiers of the declared perimeter, not the content of your systems. It rests on the adequacy decision for Canada, supplemented by the European Commission’s standard contractual clauses; transfers to the United States rest on the EU-US Data Privacy Framework for certified entities, supplemented by the standard contractual clauses.

A transfer impact assessment is made available to clients on written request to dpo@vesperid.com.

You have the right to access your data, to rectify it, to erase it, to restrict processing, to object to processing based on legitimate interest, and to portability for the data you provided to us.

Where processing relies on your consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out beforehand. A person covered by a protection profile ends it at any time, from their area or in writing; the profile is then closed.

You may also set instructions concerning what happens to your data after your death.

These rights are exercised at dpo@vesperid.com, or directly from your personal area for exporting and deleting your account. Proof of identity may be requested where there is reasonable doubt about the requester’s identity.

We respond within one month of receiving the request, extendable by two months where the request is complex, with a reasoned notice to the person concerned.

Where your data is processed on behalf of a client organisation, your request is passed to that organisation, which is responsible for it; we inform you accordingly.

If, after contacting us, you consider that your rights are not respected, you may lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or online at cnil.fr.

If you reside in another European Union member state, you may contact the supervisory authority of your place of residence.

Data is encrypted in transit and at rest. Encryption keys are managed in a dedicated service, separate from the database, and are rotated periodically.

Access to a client’s data is partitioned in the database itself, in addition to application-level controls. Members’ sensitive actions (reveal, export, status and role changes) and every support session of our staff are logged.

Two-factor authentication is mandatory for our staff and for organisation owners and managers; it is available to every member and can be imposed on everyone by the organisation. Viewing a sensitive item requires recent re-authentication and a stated reason, and remains subject to a quota of twenty reveals per person per day.

In the event of a personal data breach likely to result in a risk to individuals, we notify the supervisory authority within seventy-two hours and inform the individuals concerned where the risk is high, as well as the client acting as controller where we act on its behalf.

Monitoring data is not collected from the individuals concerned. VesperID buys no data, accesses no third-party system and interacts with no malicious actor. Intelligence data comes from a specialised provider that collects, under its own responsibility and in compliance with the law applicable to it, leaks and logs put into circulation by third parties as well as public sources: databases circulated following third-party compromises, infected-machine logs, public domain name and certificate registries, public and cybercriminal spaces, and ransomware group publication sites. Of that data we keep only metadata and short excerpts.

VesperID in no way causes, funds or facilitates the circulation of that data.

A person is monitored by name only after accepting the invitation themselves; without that acceptance, the organisation monitors only the work accounts it controls, after informing its staff.

The site sets only strictly necessary cookies (language, theme), with no analytics or advertising; the contact form and the panels’ sign-in pages load Cloudflare’s Turnstile anti-bot service; the client area and the console use session cookies and a few local storage keys. Every cookie and key, with its purpose, duration and basis, is listed on the dedicated page.

This policy may change, in particular where a subprocessor, a purpose or the regulatory framework changes. The date of the last update appears at the top of the page.

Clients are informed in writing of any substantial change affecting the processing of the data they entrust to us.