Privacy Policy · ASMGUARD

1. Who we are

ASMGUARD is a product of VerlorenEnergie, a private limited company registered in the Netherlands (KvK 95543511, VAT NL005159997B14). Our platform provides attack surface management and offensive security scanning services accessible at asmguard.com.

Contact: privacy@asmguard.com

2. What data we collect

Account data

When you register we collect your email address, display name, and a hashed password. We do not store plaintext passwords.

Scan targets and results

Domains, URLs, and API endpoints you register as scan targets. Scan findings, CVSS scores, and AI-generated reports are stored and associated with your tenant account.

Usage and audit data

Actions performed in the console are recorded in an audit log for security and compliance purposes. Audit log entries are anonymised (user_id set to NULL) rather than deleted when an account is removed.

Billing data

Payment processing is handled by Mollie B.V. We store a Mollie customer ID and subscription status. We never store full card numbers or payment credentials.

Technical log data

Standard server logs (IP address, timestamp, HTTP method, path, status code) are retained for up to 30 days for security incident investigation.

3. Legal basis for processing

We process your data on the following GDPR legal bases:

Contract performance — account management, scan execution, and report delivery.
Legitimate interest — security monitoring, fraud prevention, and audit logging.
Legal obligation — retention of financial records as required by Dutch law.
Consent — marketing emails, if you have opted in.

4. How we use your data

Provide and operate the ASMGUARD platform.
Send transactional emails (email verification, password reset, scan alerts).
Process subscription payments via Mollie.
Investigate security incidents and enforce our Terms of Service.
Improve our services through aggregated, anonymised usage analytics.

We do not sell your data to third parties. We do not use your scan data to train AI models.

5. Data sharing

We share data only with the following sub-processors, all bound by GDPR-compliant data processing agreements:

Processor	Purpose	Location
Mollie B.V.	Payment processing	Netherlands (EU)
Resend Inc.	Transactional email (fallback)	USA (SCCs)
Neon / Replit	Database & infrastructure hosting	USA (SCCs)
Sentry (optional)	Error monitoring	USA (SCCs)

SCCs = Standard Contractual Clauses approved by the European Commission.

6. Data retention

Account and scan data: retained for the lifetime of your account, then deleted within 30 days of account deletion.
Audit log entries: retained indefinitely in anonymised form.
Billing records: retained for 7 years as required by Dutch tax law.
Server logs: retained for 30 days.

7. Your rights (GDPR)

As a data subject you have the right to:

Access the personal data we hold about you.
Correct inaccurate data.
Request erasure ("right to be forgotten") — subject to legal retention obligations.
Object to or restrict processing.
Data portability — receive your data in a machine-readable format.
Lodge a complaint with the Dutch supervisory authority: Autoriteit Persoonsgegevens.

To exercise any right, email privacy@asmguard.com. We will respond within 30 days.

8. Cookies

We use only a session cookie (sv.session) necessary for authentication, and a CSRF cookie (sv.csrf) necessary for security. No third-party tracking or advertising cookies are used.

9. Security

We use industry-standard security measures including TLS encryption in transit, bcrypt password hashing, AES-256-GCM encryption for stored secrets, CSRF protection, and SSRF mitigation. For details see our security architecture documentation.

10. Changes to this policy

We may update this policy and will notify registered users by email at least 14 days before material changes take effect. Continued use of the service after the effective date constitutes acceptance.