Privacy Policy

1. Overview & Core Stance

SurfaceScan ("we", "our", or "us"), operated by SurfaceScan Technologies, provides a passive domain security posture analyzer. We hold a strict privacy-first architecture: on-demand scans require no user account, we do not sell data, we do not load third-party advertising beacons, and we do not track visitors across the web. Signing in is optional and only used when you choose to save domain watchlists, generate a Personal API key, or subscribe to SurfaceScan Pro.

All web assets, including fonts and stylesheets, are entirely self-hosted on our infrastructure. No external network requests are made to third-party font networks or public CDNs during your visit.

2. Public Domain Scan Data & Third-Party Registries

When you request a scan, SurfaceScan inspects only publicly broadcasted infrastructure information: authoritative DNS records (A, AAAA, MX, TXT, CAA, CNAME), public TLS certificate metadata, and standard defensive HTTP response headers.

To perform these passive checks, the scanned domain name is transmitted to the target origin server, standard DNS resolvers, and public infrastructure registries: Cloudflare DNS-over-HTTPS (cloudflare-dns.com for DNSSEC AD verification), RDAP servers (rdap.org and authoritative TLD registry endpoints for domain expiration dates), and crt.sh (Certificate Transparency logs for public subdomain discovery).

We never attempt authentication bypass, never brute-force private credentials, and never probe non-public network interfaces. Full request transparency and domain opt-out rules are published at /about-scanner.

3. Shareable Report Links & Retention

When you choose to generate a permanent share link via the "Share report" button, the scan result (domain, numeric score, grade, timestamp, check findings, and optional AI advice) is stored in our database under a cryptographic 128-bit random identifier.

Anyone possessing the specific share link may view the resulting read-only report. Shared reports are automatically purged from our systems after 30 days. You may request early removal of any report at any time by contacting us at our contact page or via [email protected].

4. Artificial Intelligence Advisory Service

Our optional "What to fix first" recommendations are generated using Groq, with Google Gemini as a fallback. When enabled, scan results (domain name, observed security headers, DNS summaries, and numeric grade) are processed by these third-party providers under their own terms of service and privacy policies.

Only strictly non-personal technical telemetry is transmitted—never personal identification data, cookies, or user credentials. Core domain scanning works independently without the AI advisor; if third-party AI providers are unavailable or disabled, SurfaceScan falls back to its built-in deterministic checklist.

5. Contact Form Submissions

When you submit an inquiry through our Contact Page, we collect the name, email address, message content, submission timestamp, and originating IP address.

This information is utilized solely to respond to your technical questions, investigate reported false positives, or process domain blocklist removal requests. Contact submissions are retained securely for a maximum period of 12 months, after which they are permanently deleted.

6. Rate Limiting & Aggregate Statistics

To protect our service against automated abuse and denial-of-service attempts, we temporarily process client IP addresses in volatile memory. Scans are limited to 8 requests per minute and 60 requests per day per IP address. Contact submissions are capped at 3 per hour per IP. These memory counters reset automatically and are not linked to individuals.

We store only anonymous daily aggregate counters (total scans, AI calls, fallback summaries, and scan error counts) without correlating client IPs to scanned domain names.

7. Optional Accounts, Watchlists & Billing Data

If you choose to sign in (via email/password, Google, or Telegram), we store your account identifier, display metadata, hashed password credentials (for email accounts), monitored watchlist domains, hashed Personal API keys, and alert settings to operate your dashboard. See our Cookie Policy for details on the strictly necessary surfacescan_session cookie.

When upgrading to SurfaceScan Pro ($5/month), card, Apple Pay, and Google Pay checkouts are processed by Dodo Payments (Merchant of Record), and Telegram Stars purchases are processed by Telegram under their respective privacy policies. We store only plan status, payment reference IDs, and any manual AZN transfer notes you submit—never full payment card details. See our Refund Policy for cancellation and refund terms.

8. Your GDPR & Data Rights

Under European General Data Protection Regulation (GDPR) and similar global privacy statutes, you possess rights of access, rectification, and erasure regarding any personal data we process. For inquiries or data subject requests, please email [email protected] or visit /contact.