Overview

CarbonMantis ("we", "us") provides an automated penetration testing platform. This policy explains what we collect, how we use it, and the choices you have. We collect only what we need to operate the service, and we hold ourselves to the security standard described on our Security page.

Information we collect

Account information — name, email, organization, and authentication data (passwords are stored only as Argon2id hashes).
Targets and scan configuration — the applications/APIs you register, ownership-verification records, scope, and scan settings.
Scan results and evidence — normalized findings and their evidence. Raw request/response bodies are never persisted, and evidence is redacted server-side before storage.
Billing information — credit balances and transactions. Card payments are handled by our payment processor; we do not store full card numbers.
Technical and usage data — logs, IP addresses, and telemetry used to operate, secure, and improve the service. We do not put secrets or personal data in logs.

How we use information

To provide, secure, and improve the service.
To run scans you initiate and deliver findings and reports.
To process credit purchases and prevent abuse.
To communicate about your account and service changes.

Data security

Customer data is protected with strict multi-tenant isolation and per-tenant envelope encryption for credentials, among other controls. See the Security page for details.

Data retention

Scan results and artifacts are retained per your configurable retention settings. Account data is retained while your account is active; an account with no scans for 12 months may be treated as dormant and scheduled for deletion. You may request deletion of your data at any time.

Sharing

We do not sell your data. We share it only with service providers (subprocessors) that help us operate the platform — for example cloud infrastructure and payment processing — under appropriate contractual protections, and where required by law.

Your choices and rights

Depending on your location, you may have rights to access, correct, export, or delete your personal data. Contact us to exercise them.

Cookies

We use strictly necessary cookies for authentication and session management. We will update this section if we introduce analytics or preference cookies.

Changes

We may update this policy; material changes will be communicated through the service.

Contact

Questions about privacy? Email [email protected].

Privacy Policy