Privacy Policy

Last updated: August 15, 2026

AYAsec s. r. o. · Pribinova 10, 81109 Bratislava, Slovakia, EU · 57804613

AYAsec ("AYAsec," "we," "us," or "our") provides an automated security scanning platform that helps organizations monitor the TLS/SSL configuration, network exposure, DNS security, HTTP headers, and attack surface of the domains and infrastructure they submit for scanning. This Privacy Policy explains what information we collect, how we use it, and the choices you have. It applies to ayasec.ai and app.ayasec.ai (the "Service").

Information We Collect

Account information. When you create an account, we collect your e-mail address, display name, and password (stored as a salted hash, never in plain text) - or, if you sign in with Google or GitHub, the basic profile information those providers share with us. We also store your role and organization membership.

Scan target and results data. The domains, IP addresses, and hostnames you submit for scanning, along with the results we generate - findings, CVE/CWE references, security grades and scores, and historical scan reports.

Technical data. Standard information generated by using a web service, such as IP address, browser type, and access timestamps, used primarily for security and troubleshooting.

Communications. If you contact us for support, we keep that correspondence to respond to and track your request.

We do not currently collect payment or billing information.

How We Use Your Information

• Operate the Service - run the scans you request and generate your reports and dashboards
• Authenticate you and maintain your session
• Send service-related communications, such as security alerts when a target's grade changes, and account/e-mail verification messages
• Maintain, secure, and improve the Service
• Comply with legal obligations

How We Share Your Information

We do not sell your personal data. We share information only in the following circumstances:

• Service providers who help us operate the Service (for example, hosting and e-mail delivery), under obligations to protect your data and use it only for the purposes we specify.
• Authentication providers (Google, GitHub) - only if you choose to sign in using one of these, and only to the extent needed to authenticate you.
• Threat-intelligence lookups. When you scan a domain or IP address, we may query third-party services - such as DNS blocklists, IP-reputation databases, and public vulnerability databases - using the target you specified, to enrich your findings. This does not involve sharing your personal account information.
• Analytics and visitor-identification providers (Google Analytics, Microsoft Clarity, and Akviro) - active only on ayasec.ai, our marketing site, not app.ayasec.ai. Akviro identifies the businesses visiting our website based on IP address, to help us understand which organizations are interested in AYAsec; it does not identify individual visitors personally.
• Legal reasons, if required to comply with a legal obligation, protect our rights, or protect the safety of our users or the public.

Data Retention

We retain your account data for as long as your account is active. Scan results and reports are retained as part of your account's history so you can track changes over time. If you would like your account or data deleted, contact us at the address below.

Your Rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal data, restrict or object to certain processing, and withdraw consent where processing is based on consent. To exercise any of these rights, contact us at security@ayasec.ai. If you are in the European Economic Area, you also have the right to lodge a complaint with your local data protection authority.

Security

We use reasonable technical and organizational measures to protect your information, including encrypted connections (TLS/HTTPS), hashed credentials, and access controls limiting who within our organization can view your data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Cookies & Analytics

We use a small number of strictly necessary cookies to keep you signed in (an httpOnly session cookie). On ayasec.ai, our marketing site, we also use Google Analytics and Microsoft Clarity to understand how visitors use the site, and Akviro to identify the businesses visiting from their IP address (see "How We Share Your Information" above) - not to advertise to you. None of these run on app.ayasec.ai.

International Data Transfers

Depending on your location, using the Service may involve transferring your information to servers located outside your country. Where required, we take steps to ensure such transfers comply with applicable data protection law.

Children's Privacy

The Service is intended for business use and is not directed at, nor do we knowingly collect information from, children under 16.

Changes to This Policy

We may update this policy from time to time. We will update the "Last updated" date above when we do, and for material changes we will make reasonable efforts to notify account holders.

Contact Us

Questions about this policy or your data? Contact us at security@ayasec.ai.