Privacy policy
Introduction
Foresecur AB, a Swedish company registered in Stockholm, operates the Foresecur portal. This policy explains what we collect, why, and what you can require of us. It is written to be read rather than to be defensible.
Information we collect
Account details for the people you invite: name, work email, role. The domains and addresses you ask us to watch. Findings we discover about those domains and addresses. Server logs of requests to the portal. Separately, any address entered into the public check on our website is kept for 36 months as a sales contact, whether or not you go on to become a customer; that address is not monitored and no alerts are sent for it.
How we use it
To run the monitoring you asked for, to send the alerts you enabled, and to keep the service working. We do not sell it, we do not share it with advertisers, and we do not train models on it.
Data security
Transport is TLS. Contact and billing columns are encrypted at the application layer. Every table holding customer data has row-level security forced at the database, so one customer's rows are unreachable from another customer's session rather than merely filtered out of it. One role per user, one organisation per user, checked on the server against a signed session and never against anything the browser claims. Multi-factor authentication is available and can be required. The password check sends five characters of a hash and nothing else. We hold no security certification: not SOC 2, not ISO 27001. When that changes it will say so here, with the date of the report.
Data retention
Findings are kept for 36 months and then deleted by a nightly job. You can set a shorter period in your organisation settings; nothing can extend it past 36 months. Audit logs are kept 90 days. Enquiries sent through the contact form and results from the public check are kept 36 months. Everything is deleted when you close the account or ask us to.
Your rights
Under GDPR you can ask for a copy of your data, correction of it, deletion of it, and restriction of how it is processed. Ask at the address in section 09 and we act within one month.
Cookies
The portal sets a session cookie so you stay signed in. The marketing site sets none. There is no advertising or analytics cookie on either.
Third parties
Hosting is AWS in eu-north-1, Stockholm. Breach data comes from Have I Been Pwned, dark web results from IntelX, and transactional email goes through SendGrid. Each is a processor under contract and none receives more than the service needs.
Contact
Foresecur AB, Stockholm, Sweden. Write to hello@foresecur.com and say what you want; a request under section 06 does not need a particular form of words.