1. Scope
This Privacy Policy explains how OpenSec (“OpenSec,” “we,” “us,” or “our”) handles personal information when you visit opensec.in, create or use an OpenSec account, request early access, subscribe to the OpenSec Dispatch, contact us, or otherwise use our services.
2. Information we collect
Account and identity information
When you create an account, we process your email address and the authentication information needed to secure your account. If you sign in with Google or GitHub, we receive the identifier and basic profile information that provider makes available for authentication, such as your email address, display name, and profile image. We do not receive your Google or GitHub password.
Requests and communications
Early-access requests may include your name, work email, organization, message, confirmation status, and newsletter choice. Newsletter records include your email address, consent status, and subscription timestamps. If you contact us, we process your contact details and the contents of your message.
Service and security information
We process technical information needed to operate and protect the service. This can include request times, browser or device information, authentication events, diagnostic data, and network identifiers in server logs. Our signup rate limiter stores a one-way hash derived from an IP address rather than the raw IP address in the signup database. OpenSec also stores necessary session tokens and preferences in your browser.
Workspace content
When product workspace features are connected to production services, we may process repositories, source code, scan configuration, findings, team information, and other content you choose to provide. We use this content only to provide, secure, and improve the services you request, subject to any separate agreement with your organization.
3. How we use information
- Provide accounts, authentication, workspaces, and requested services.
- Confirm early-access and newsletter requests and send service emails.
- Respond to questions, support requests, and security reports.
- Prevent abuse, investigate incidents, and protect users and systems.
- Maintain, diagnose, and improve reliability and user experience.
- Comply with law and enforce our agreements.
Depending on where you live, we rely on consent, performance of a contract, compliance with legal obligations, and our legitimate interests in operating and securing OpenSec. You can withdraw consent where consent is the basis for processing.
4. Google user data
OpenSec requests only the basic Google identity information needed to sign you in and secure your account. We do not use Google user data for advertising, sell it, or allow people to read it except when necessary to provide or secure the service, comply with law, or with your affirmative agreement. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
6. Retention
We retain account information while your account remains active and as needed for security, legal, and operational purposes. We retain confirmed newsletter information until you unsubscribe or ask us to delete it. Early-access and support records are retained for as long as reasonably necessary to respond and administer those requests. Shorter retention periods apply to rate-limit records; backups and security logs may persist for a limited additional period.
7. Security
We use technical and organizational safeguards designed to protect information, including encrypted transport, access controls, restricted service credentials, and database authorization policies. No service can guarantee absolute security, so please use a strong, unique password and tell us promptly about suspected unauthorized access.
8. Your choices and rights
You may unsubscribe from the newsletter using the link in an OpenSec message. You may also ask to access, correct, export, or delete your personal information, object to or restrict certain processing, or withdraw consent. Rights vary by location and may be subject to lawful exceptions. We may need to verify your identity before completing a request.
OpenSec currently uses necessary browser storage for authentication, security, and saved preferences. We do not currently use advertising cookies. Blocking necessary storage may prevent account features from working.
9. International processing
OpenSec and its providers may process information in countries other than your own. Where required, we use appropriate safeguards for those transfers and apply the protections described in this policy.
10. Children
OpenSec is a professional security service and is not directed to children under 18. We do not knowingly collect personal information from children through the service.
11. Changes to this policy
We may update this policy as OpenSec evolves. We will publish the revised version here, update the effective date, and provide additional notice when required by law.
12. Contact us
For privacy questions or requests, email [email protected].