Privacy Policy

1. Who we are and what this covers

This policy explains how Enterprise.Systems ("we") processes personal data on 8200.dev. For account and website data we are the controller. For data inside sources your organization connects ("Customer Source Data"), your organization is the controller and we are its processor under the Data Processing Agreement — your organization’s own privacy notices govern that data.

2. Data we process

We process the following categories:

• Account data — email address, name, password hash (scrypt; we never store the password itself), organization name, role, and locale; if you use them, your second-factor (TOTP) secret, stored encrypted, and a record of your sign-in sessions (time, IP address, and browser). If you created your account with an email address and password after arriving from a marketing-campaign link, we record, once and with your organization, the campaign's source, medium and name and the host name of the site that referred you, to measure which campaigns lead to sign-ups; we use no cookie or other storage on your device for this.
• Customer Source Data — metadata and permission information from connected sources, obtained read-only via the OAuth scopes you approve: resource names and identifiers, sharing settings, permission grants, and the identities of principals holding access (people, service accounts, and AI agents). We do not read or store the contents of your files. For a WhatsApp Business Account the connector also reads, through Meta's management API and read-only: the account's business phone numbers (display number, verified name, status, quality rating and messaging limit tier), whether two-step verification is on, the apps subscribed to the account, and the names and task levels (for example Manage) of the users assigned to it. It makes read requests only: it does not read or send WhatsApp messages and it does not change the account.
• Findings — the security findings, explanations, and evidence the platform generates for your organization.
• Usage and log data — IP address, user agent, timestamps, and an append-only audit trail of actions taken on the platform.
• Cookies — a small set of first-party cookies for sign-in, security, and your preferences, plus — only if you agree — a partner-referral cookie; the full list is in section 15. We use no advertising, analytics, or cross-site tracking cookies.

2A. The AI Exposure Check

This section applies to the free AI Exposure Check. You do not need an account to use it. Enterprise.Systems is the controller of the data described here. We rely on our legitimate interest in running a free public tool and preventing its abuse (GDPR Art. 6(1)(f)), and on your consent for the optional e-mails (Art. 6(1)(a)). Your rights, including the right to object, how to complain, and international transfers are in sections 8 and 9; data requests go to [email protected].

What we process:

• The domain you enter, reduced to its main (registrable) domain, and the public DNS records of that domain, of the names its mail records refer to, and of a fixed list of common names under it (for example www, autodiscover and DKIM selectors), read at the moment of the check. The check turns them into a score, counts and status flags. The saved result holds those and no record values or service names.
• To apply limits and prevent abuse: your IP address. We send it, with the token from the human check, to Cloudflare Turnstile to verify the check. Our counters hold only a keyed hash of it (a one-way code made with a secret key; for IPv6, of the /64 network), never the address. To apply the limit on different domains per day, a daily counter is kept under a keyed hash of the network together with the domain. If you are signed in, your account ID is the key of your daily counter. For each domain we also keep a counter, so that it is checked afresh at most once a day, and a daily total of fresh checks with no domain and no IP address.
• To limit confirmation e-mails: a keyed hash of the e-mail address, with a counter, kept for 7 days. It can outlive the address, which is deleted sooner.
• Only if you choose to: a share card, and an e-mail address with the domain and your consent (below).
• The check writes no entry to the audit trail.

How long we keep it:

• The saved result of a check (the domain, the score and counts, and a random link token): 24 hours, then deleted automatically; the clean-up runs every hour. Anyone who checks the same domain in that time gets the saved result, and the result link shows the score and counts, not the domain.
• Limit counters: deleted by the hourly clean-up once the hour or UTC day they cover has ended, so at most 26 hours after they are created; the e-mail counter is kept 7 days.
• A share card (created only when you click "Create a share link"): the score, the counts and the date, and the domain only if you tick "Show the domain on the card". It has a random, unlisted link, works for 30 days and is then deleted. Copies that other sites make when you post the link are outside our control and are not deleted by us.
• An e-mail address: see the next paragraph.
• Backups: deleted rows, including saved results and limit counters, can stay in our encrypted backups for up to about 56 days.

Your e-mail address (optional). On a result you can give an e-mail address. We store it only if you tick the consent box yourself; the box is never ticked in advance. We then send an e-mail with a link to confirm the address (at most 3 such e-mails per address in each fixed 7-day period). Until you confirm, we send no other e-mail. The entry holding an address that is not confirmed is deleted within 48 hours. After you confirm, we send you the result as a short text summary and one reminder about 30 days later, inviting you to check again. The summary is kept with the address until the entry is deleted. Every e-mail has an unsubscribe link; one click on the page it opens stops the e-mails and deletes this address-and-domain entry. We keep a confirmed address with the domain and the version and time of your consent for up to 12 months, then delete it. The e-mails themselves are kept as a delivery record for up to 30 days, after which their address and text are scrubbed. We use the address for nothing else, do not sell it, and give it to no one except our e-mail provider Resend, which delivers through Amazon SES. If someone enters your address without your knowledge, ignore the confirmation e-mail: the entry holding it is deleted within 48 hours.

Who receives what. Cloudflare’s public DNS resolver receives the DNS questions about the domain name; they are asked from our servers, so it does not receive your IP address. Google’s public DNS resolver is an independent recipient: it receives the same questions (domain names only) only if Cloudflare’s resolver fails, and it is not our subprocessor. Cloudflare Turnstile runs in your browser, is loaded from challenges.cloudflare.com, and receives your IP address and browser details to decide whether you are a person. Resend and Amazon SES receive the optional e-mails. Our e-mail provider keeps its own send logs for 30 days.

Information about other organizations. A domain usually belongs to an organization, and DNS records are public. Some records can contain personal data, for example an e-mail address in a DMARC record. We read them only to compute the score and counts, and we do not show record values in a result. The result for a domain is public to anyone who checks it. There is not yet a way for a domain owner to opt out of the public result. The check does not use a large language model.

3. How we use data

We use data to provide and secure the service: enumerating permissions, generating findings and plain-language explanations, carrying out the remediation actions you armed if you turned on Auto-remediate, authenticating you, sending transactional email, providing support, and meeting legal obligations. We do not sell personal data, we do not show ads, and we do not use Customer Source Data to train AI models.

4. Lawful bases (GDPR)

Where the GDPR applies, we rely on:

• Performance of a contract (Art. 6(1)(b)) — operating your account and producing findings.
• Legitimate interests (Art. 6(1)(f)) — securing the platform, preventing abuse, and improving detection quality.
• Consent (Art. 6(1)(a)) — optional communications; withdrawable at any time.
• Legal obligation (Art. 6(1)(c)) — accounting, tax, and lawful requests.

5. AI processing

We use large language models through the Anthropic API for three things: (a) the in-product support assistant, which receives the messages you type, exactly as you type them, and, when you are signed in, a short account summary made only of aggregate facts (your plan, how many sources are connected and whether they are healthy, your posture score and grade, how many findings are open and how many are critical, and your team size); (b) executive-summary narratives you ask for, which receive only aggregate figures: your posture score and grade, its trend over the period, finding counts by severity, your peer percentile, plan names, and your most common risk categories as generic category labels with a count (for example “Public link share (link-only): 3”); and (c) translating the interface into additional languages, which sends interface text only. None of these requests contains an identifier from your connected sources: no file, folder or drive names, no user or account names, no email addresses, no paths, no account IDs, and not your organization’s name. We never send file contents or credentials. Under Anthropic’s commercial terms, data submitted via the API is not used to train Anthropic’s models.

6. Subprocessors and sharing

We share personal data only with the subprocessors below, with professional advisers under confidentiality, or where the law requires:

• Anthropic (USA) — the AI support assistant, executive-summary narratives, and interface translation.
• Cloudflare (global) — CDN, TLS termination, and DDoS protection; for the AI Exposure Check also the human check (Turnstile) and a public DNS resolver (DNS-over-HTTPS).
• RunPod (USA/EU) — cloud infrastructure hosting the platform.
• Resend (USA) — transactional email delivery; delivery itself is performed by Amazon SES, Resend's own subprocessor.
• PayPal (USA) — subscription billing and payment processing.
• Telegram (global) — operational alerts to our on-call team. Alerts carry internal identifiers, statuses and amounts; they are not designed to contain your personal data, and email addresses are removed automatically before sending. We found no Article 28 data-processing agreement published by Telegram.
• Sentry (USA; operated by Functional Software, Inc.) — error diagnostics, server-side only. Error reports carry the error message, stack trace (with a few lines of the server code around each frame: ours and the open-source libraries it runs), request path and request ID, recent log lines and request URLs, a short allowlist of request headers (including user-agent) and runtime metadata (release, environment, server host name). Email addresses, phone numbers, IP addresses, tokens and long secret-like strings are removed before sending; identifiers in a request path, such as an organization or user ID, are sent. No cookies, request bodies, query strings or session replay are sent.

We update this list here; organizations with a DPA receive advance notice of additions per the DPA.

7. Retention

We keep data no longer than needed:

• Account data — for the life of your account. Account deletion has a 7-day grace period, after which data is permanently purged. We keep the records the law requires us to keep (invoices, credit notes, and payment and refund records) for the period the law requires, 7 years under Israeli law, even after you delete your account. We delete the rest of your account data. Copies of deleted data in our encrypted backups are removed as the backups rotate, within about 56 days; this does not affect the records above.
• Findings and permission snapshots — 24 months by default, or the period your organization configures.
• Operational and audit logs — 90 days.
• Deleting your account also deletes organizations you solely own, including their connectors (stored credentials are destroyed immediately), snapshots, and findings. Disconnecting a source — in 8200.dev open Connectors and choose Disconnect. Where the provider supports it, we first revoke the access grant at the provider; then the stored credentials and the source's resources, scans and permission snapshots are deleted. Findings already generated stay for the period above, or until you delete the account. You can also remove 8200.dev yourself from the connected apps in the provider. To export or delete your data, use Settings.
• AI Exposure Check — saved results 24 hours; limit counters at most 26 hours (the e-mail counter 7 days); share cards 30 days; an e-mail entry 48 hours if not confirmed and up to 12 months once confirmed, and the e-mails sent as a delivery record 30 days; deleted rows stay in encrypted backups for up to about 56 days; our e-mail provider keeps its own send logs for 30 days (details in section 2A).

8. Your rights

Under the GDPR and similar laws you have the right of access, rectification, erasure, portability, restriction of processing, and objection, and the right not to be subject to solely automated decisions with legal effect (the platform makes none about you). Export and erasure are self-serve: Settings → Export my data / Delete my account. For anything else, write to [email protected] — we respond within 30 days. You may also lodge a complaint with your supervisory authority.

9. International transfers

We are based in Israel, which holds an EU adequacy decision; infrastructure runs in the regions listed under Subprocessors. Where personal data is transferred from the EEA/UK to countries without adequacy, we rely on the European Commission’s Standard Contractual Clauses (SCCs) and equivalent UK safeguards, plus supplementary technical measures (encryption in transit and at rest).

10. California (CCPA/CPRA)

We do not sell or share personal information as defined by the CCPA/CPRA, and we have not done so in the preceding 12 months. California residents have the rights to know, correct, delete, and not be discriminated against for exercising them — use the self-serve tools in Settings or [email protected].

11. Security

Data is encrypted in transit (TLS) and stored credentials are encrypted at rest (AES-256-GCM). Monitoring access to your sources is read-only and least-privilege; write access exists only if you turn on Auto-remediate and grant it separately, and you can revoke it at any time. Passwords are stored only as salted scrypt hashes. Every platform action is written to an append-only audit log. We notify affected organizations of personal-data breaches without undue delay, consistent with GDPR Articles 33–34.

12. Children

The platform is a B2B service and not directed at children. We do not knowingly process data of anyone under 16 as an account holder.

13. Changes to this policy

We post changes here and update the effective date at the top of this page; a change takes effect on that date.

14. Google API Services

8200.dev's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

We do not use any raw or derived Google Workspace user data to develop, improve, or train generalized artificial-intelligence or machine-learning models, and we do not transfer such data to third-party AI or ML tools or services for training purposes. Large-language-model analysis on the platform (via the Anthropic API) is inference-only, and under Anthropic’s commercial terms data submitted through the API is never used to train Anthropic’s models.

15. Cookies

We set only the first-party cookies below. None is used for advertising, analytics, or tracking you across other sites. All of them are strictly necessary or remember a choice you made — except es8200_ref, which is set only with your consent.

• authjs.session-token — keeps you signed in; ends when you sign out or after 30 days without use.
• authjs.csrf-token and authjs.callback-url — protect the sign-in form and return you to the page you came from; they last for the browser session.
• authjs.pkce.code_verifier, authjs.state, and authjs.nonce — protect a Google sign-in until it completes; 15 minutes.
• mfa_trust — remembers a device you chose to trust after a second-factor check; 30 days; set only if you choose it.
• active_org — remembers which of your organizations you are viewing; 1 year.
• NEXT_LOCALE — remembers your language; 1 year.
• es8200_plan — remembers the plan you picked on the pricing page so that sign-up can take you to checkout; 24 hours.
• es8200_ref — category “Partner referral”, optional: set only if you accept it in the banner shown when you arrive through a partner’s link. It records the referral code so the partner gets their commission if you subscribe; 90 days.

In production the sign-in cookies carry the __Secure- prefix and are HttpOnly and Secure. Your light or dark theme choice is kept in your browser’s local storage, not in a cookie, and is never sent to us. You can delete cookies in your browser at any time; without the sign-in cookies you cannot stay signed in.

16. Contact and data protection officer

For product support and general enquiries, contact [email protected]. Privacy and data-protection contact (including for the DPO function): [email protected].