Privacy notice · last changed 30 September 2026
What we hold about you, and what you can make us do with it
Written against what the platform actually does, read from its source and checked on the running service — not from a template. Where something is not in place yet, this page says so rather than implying it.
Who is responsible
Exception Security is a trading name of Vivek Kumar, who is responsible for the personal data described here — except where we handle data on a client's behalf, which is explained in its own section below. Write to support@exceptionsecurity.com about anything on this page.
If you visit this site
Our web server records each request's IP address, time and the page asked for, because that is how an attack on the site is noticed and traced. The log is kept in India for 180 days, the period Indian cyber-security rules set for such logs, and then deleted automatically. Nothing else about a visit is collected: no cookies for tracking, no analytics. Why we may. Our legitimate interest in keeping the service secure.
If you contact us
What we collect. The name, work email address and organisation you give us, optionally your website and where you operate, and whatever you write.
What we do with it. We read it and reply. It reaches one mailbox. We do not use a CRM, there is no analytics on this site, no advertising pixel, and no third-party fonts or scripts — your browser talks to this domain and nothing else. You are not added to a list.
How long. Until you ask us to delete it, or until we no longer need it to answer you. Deletion is a real operation: the enquiry is removed, and what remains is a record that an enquiry arrived and when, with no name, address, message or IP attached.
Why we may. Our legitimate interest in answering a business enquiry you chose to send.
If you ask for a domain snapshot
The address you give is used to send you that one report. It is not kept in our database, our server logs or our own copy of the request, and it is not added to any list. We record that a snapshot was run for the domain, so we can say later why our server requested its home page.
If you use the platform for a client
We hold the names, work email addresses, job titles and organisation of the people your organisation nominates, their sign-in data — a password verifier (Argon2id, never readable), second-factor secrets or passkeys, and session records — and what is exchanged about an engagement. We use it to provide the service your organisation engaged us for.
If you are a researcher
Before anyone is invited to test a client's systems we verify who they are. That means we hold your legal name, document number and date of birth, encrypted, and — for payment — bank and tax details, encrypted. They are decrypted only inside the operation that needs them.
The image of your identity document is destroyed as soon as a decision is made on it, whether it is approved or rejected. It is encrypted while it waits for review. What survives the decision is its fingerprint (SHA-256), the document type, the issuing country and its last four characters — enough to show later that a document was seen, and which one, without holding it.
A client is never given your name and cannot ask for it. We use these details to perform our agreement with you and because we must know who we are authorising to test a client's systems.
If you report a vulnerability to a programme we run
We keep your name, email address and the IP address the report came from, together with the report. The organisation the report is about receives the technical substance once we have checked it — never your name or contact details. You can ask us to erase your details at any time; the report itself stays, because the organisation may still need to fix what it describes. Where the programme is a client's, we handle the report on that client's behalf.
If your data is inside a finding
When a researcher proves that a system exposes data, the evidence can contain real personal data about the people that system holds records on. If yours is among it, it reached us because the organisation holding it asked us to test its systems. We hold it as evidence of the flaw, encrypted, visible only to our operations team and to that organisation, and use it for nothing except proving and fixing the finding. That organisation decides what happens to its data and we act on its instructions; write to us and we will pass your request to them.
Where it is kept, and who else touches it
| What | Where |
|---|---|
| The platform, its database, and identity documents awaiting review | Oracle Cloud, Mumbai, India |
| Evidence files from findings | Cloudflare R2, encrypted before upload |
| Name lookups for this domain (DNS) | Cloudflare. It answers DNS only and does not carry the traffic, which reaches our own server directly |
| Background jobs, cache and rate-limit counters | Upstash (managed Redis). No evidence and no identity documents |
| Email the platform sends | Zoho Mail, India region (sent from notifications@exceptionsecurity.com) |
| Email we send and receive as people | Zoho Mail, India region |
That is the whole list. No external AI service processes client material.
India has no adequacy decision from the European Union or the United Kingdom. We do not yet have Standard Contractual Clauses in place. If your organisation needs a transfer mechanism before sharing personal data with us, raise it before an engagement begins.
How it is protected
- Identity details, document contents, message bodies, bank details and tax identifiers are encrypted at rest with AES-256-GCM.
- Passwords are hashed with Argon2id.
- Every operator account requires a second factor.
- Every consequential action is written to a hash-chained audit log; altering a past entry breaks the chain visibly, and it is re-checked on a schedule.
- Every evidence download re-checks the file's hash and refuses to serve a file that has changed.
We do not hold ISO 27001 or SOC 2 certification, and we have not commissioned an independent penetration test of this platform. We would rather say so here than have you find it out.
How long evidence is kept
Evidence attached to an engagement is kept for a retention period — 365 days unless the engagement sets another — and then deleted automatically. A legal hold, placed when a matter requires it, overrides the deletion until it is lifted.
What you can ask for
Depending on where you are, you can ask for a copy of your data, have it corrected or deleted, restrict or object to how it is used, and complain to a data protection authority. Write to support@exceptionsecurity.com. We answer within one month.
What we can do today, stated exactly:
- Enquiries and reporter details — erasure is a built operation, and the erasure is itself recorded.
- Platform accounts and researcher records — handled by a person working against the database. There is no self-service export or deletion screen yet.
- The audit log — entries are not removed; a chain with gaps proves nothing. It records who did what and when, and does not hold the substance of anyone's personal data.
Where we handle your data on a client's behalf, we pass your request to them, because the decision is theirs.
Complaints
Write to us first if you are willing to — most things can be put right quickly. You can also complain to the data protection authority where you live or work; in India, that is the Data Protection Board of India.
Changes
When what we do changes, this page changes, and the date at the top moves.