Legal

Record of processing activities

Our record under Article 30 of the UK GDPR and the EU GDPR: every activity in which we process personal data, as controller and as processor for our customers.

Last reviewed 22 October 2026. We maintain this record under Article 30 and review it whenever a processing activity, provider or retention period changes. It complements our privacy policy, which explains your rights, and the sub-processor register on the trust centre. To ask a question or request a copy of this record in another format, email privacy@scoutsentinel.com.

Controller details

ScoutSentinel and Violuna Labs are business names of a sole trader in Australia, ABN 32 245 978 295.

Controller details
Controller	A sole trader in Australia trading as Violuna Labs and ScoutSentinel
Australian Business Number (ABN)	32 245 978 295
ICO registration number	Registration with the ICO is in progress.
Privacy contact	privacy@scoutsentinel.com
Data protection officer	None appointed. Questions go to the privacy contact.
UK representative (UK GDPR Article 27)	Not yet appointed
EU representative (EU GDPR Article 27)	Not yet appointed

General transfer position: personal data can be processed outside Australia, the UK and the EU. Providers' contracting entities, locations and transfer mechanisms are taken from their public terms; items that depend on our production configuration say "to confirm". Security measures are summarised in each record and described on the trust centre.

Part A: processing as controller

Article 30(1). Activities for which we decide why and how personal data is processed.

Website delivery and security logs

Purpose

Deliver this website, the app and the API, and protect them from attack and misuse; investigate faults.

Lawful basis

Legitimate interests (Article 6(1)(f)).

Legitimate interest: Serving and protecting the website and service. Request data is limited to what the hosting platform processes to deliver a page, and platform logs are kept for a short fixed period.

Data subjects

Website visitors
App and API users

Personal data

IP address and user agent
Page or route requested and the time
Structured platform log fields

Source

The visitor's browser or API client.

Recipients

Cloudflare, Inc.: platformSub-processorHosting, CDN, DNS and platform logs (Workers Logs).Location: Cloudflare's global network; processing can take place in any Cloudflare location. No data-location restriction is set today. Evidence and report storage is moving to EU-jurisdiction R2 buckets (planned).

International transfers

Retention

Cloudflare keeps these logs for 7 days and then deletes them.

Security measures

Encryption in transit and at rest, tenant isolation with row-level security, role-based access and an append-only audit log. Staff access to the admin console and to staging goes through Cloudflare Access. Trust centre.

Website and app analytics and browser error reports

Purpose

Understand how the website and app are used and find faults in the browser, so they can be improved.

Lawful basis

Consent (Article 6(1)(a)). Analytics start only after the visitor chooses "Accept analytics"; Global Privacy Control and Do Not Track count as a refusal unless the visitor turns analytics on. Consent can be withdrawn at any time in "Cookie settings" on the website or Settings > Security in the app.

Data subjects

Website visitors who accept analytics
App users who accept analytics

Personal data

An anonymous id held in memory for the page (a reload starts a new one); for signed-in app users, the internal user id and organisation id
Page addresses and referrers with query strings and fragments removed and identifier-like path segments replaced
Browser, operating system, device type and screen properties that the analytics library adds to events
Named actions, such as a sign-up request
Browser error type, a message scrubbed of email addresses, tokens, query strings and long digit runs and cut to at most 200 characters, and stack frames reduced to file and position
The release that sent the event

Source

The visitor's browser, after consent.

Recipients

PostHog Inc.Sub-processorPostHog EU Cloud, reached through our proxy p.scoutsentinel.com, which does not pass the IP address on.Location: PostHog EU Cloud (AWS, Germany); PostHog also processes data outside the EU, including in the United States. Browser events use our proxy p.scoutsentinel.com, API error reports go directly to eu.i.posthog.com.
Cloudflare, Inc.: platformSub-processorRuns the first-party proxy.Location: Cloudflare's global network; processing can take place in any Cloudflare location. No data-location restriction is set today. Evidence and report storage is moving to EU-jurisdiction R2 buckets (planned).

International transfers

PostHog EU Cloud (AWS, Germany); PostHog also processes data outside the EU, including in the United States. Safeguard: the PostHog DPA, signed 22 October 2026, with EU standard contractual clauses, the UK Addendum and the Data Privacy Framework.

Retention

PostHog sets no cookies and writes no local storage on our sites; the visitor's choice is stored on their device under scoutsentinel.analytics.
Analytics events: PostHog keeps events for the retention period of our PostHog plan (1 year on its free plan, 7 years on paid plans); it has no shorter setting. Events of a signed-in user are deleted with their account (see account erasure).

Security measures

No autocapture, no session recording, no cookies; text and element attributes are masked; the IP address property is dropped before sending. Trust centre.

Waitlist

Purpose

Answer people who register interest, invite them when we open up, and, with their consent, send launch news.

Lawful basis

Legitimate interests (Article 6(1)(f)) for running the waitlist and answering; consent (Article 6(1)(a)) for launch emails, given by ticking the box and confirming the address.

Legitimate interest: Responding to people who asked to hear from us. Only what the form asks for is kept, and an unconfirmed entry is removed after 7 days.

Data subjects

People who join the waitlist

Personal data

Email address and, if given, name, company, website and what they told us about their interest
The page they signed up from, the launch-email tick and when the address was confirmed
A keyed fingerprint of the IP address (not the address; it cannot be reversed without our secret key)

Source

The person, through the waitlist form.

Recipients

Cloudflare, Inc.: platformSub-processorHosting and the confirmation email (Email Service).Location: Cloudflare's global network; processing can take place in any Cloudflare location. No data-location restriction is set today. Evidence and report storage is moving to EU-jurisdiction R2 buckets (planned).
PlanetScale, Inc.Sub-processorStores the entry.Location: AWS eu-west-1 (Ireland), for staging and production.
Cloudflare, Inc.: TurnstileSub-processorBot check on the form; see platform security.Location: Cloudflare's network.

International transfers

Cloudflare runs on a global network and can process data in any Cloudflare location; no data-location restriction is set today. Safeguard: the Cloudflare Data Processing Addendum, part of Cloudflare's terms (EU standard contractual clauses with the UK Addendum, and the Data Privacy Framework with the UK Extension). PlanetScale: staging and production databases in AWS eu-west-1 (Ireland). Safeguard: the PlanetScale DPA, part of its terms (EU standard contractual clauses and UK controller-to-processor clauses).

Retention

An entry whose confirmation link expires unused, 7 days after our email, is deleted by a daily job, unless we have already invited or declined it.
Otherwise until the person asks us to delete it, and at the latest 12 months after self-serve signup opens, when a daily job deletes the whole list.

Security measures

Encryption in transit and at rest, tenant isolation with row-level security, role-based access and an append-only audit log. Double opt-in with a single-use confirmation link. Trust centre.

Accounts, sign-in and sessions

Purpose

Create and administer user accounts, authenticate users and keep their accounts secure.

Lawful basis

Contract (Article 6(1)(b)) where the user is a party; otherwise legitimate interests (Article 6(1)(f)) in providing the service to customer organisations and their authorised users and in protecting accounts.

Legitimate interest: Providing the service to the organisations that buy it and keeping their accounts secure. Sign-in records are kept for short fixed periods for investigation.

Data subjects

Customer users (account holders, invited members)

Personal data

Name, work email, organisation, role and sign-in method
Password hash; two-factor settings (authenticator secret, recovery codes); single-use sign-in links
With Google or GitHub sign-in: name, email address and avatar from the provider; with Microsoft sign-in: name and email address (no avatar is returned)
With an organisation's own single sign-on: the identity its OIDC provider returns
Sessions (IP address, browser and sign-in method); sign-in attempts (email or key prefix, IP address, success)
API keys and OAuth grants

Source

The user; the sign-in provider they choose; the organisation's identity provider when it sets up single sign-on.

Recipients

Cloudflare, Inc.: platformSub-processorHosting, session handling and sign-in and invitation emails (Email Service).Location: Cloudflare's global network; processing can take place in any Cloudflare location. No data-location restriction is set today. Evidence and report storage is moving to EU-jurisdiction R2 buckets (planned).
PlanetScale, Inc.Sub-processorStores accounts, sessions and sign-in records.Location: AWS eu-west-1 (Ireland), for staging and production.
Google, Microsoft and GitHubIndependent controllerWhen the user chooses to sign in with them. Google and GitHub also serve avatar images, so the viewer's browser sends them its IP address and user agent.
The organisation's own OIDC identity providerCustomer-enabled destinationWhen the organisation sets up single sign-on.

International transfers

Retention

Account data for the life of the account; see account erasure. An account that has had no organisation, no open invitation and no sign-in for 12 months is erased in the same way.
Sign-in attempts for 90 days; each session for 30 days after it ends by sign-out, expiry or revocation. A daily job deletes them.

Security measures

Encryption in transit and at rest, tenant isolation with row-level security, role-based access and an append-only audit log. Passwords are checked against a list of common breached passwords held locally; sign-in throttling per account and IP with backoff; two-factor authentication and step-up re-authentication for sensitive actions. Trust centre.

Organisation administration and audit log

Purpose

Let customer organisations manage members, roles, invitations, API keys and settings, and keep a record of who changed what to protect their evidence.

Lawful basis

Contract (Article 6(1)(b)); legitimate interests (Article 6(1)(f)) in providing the service and protecting accounts and evidence.

Legitimate interest: An organisation and its users need to see who changed its configuration and who accessed its evidence. Audit retention is set by the organisation within its plan.

Data subjects

Customer users
People invited to an organisation
ScoutSentinel administrators acting on an organisation

Personal data

Memberships, roles and invitations (email address of the invitee)
Audit rows: actor id, action, object, time, IP address and details of the change
Evidence access log: who downloaded, exported, extended or erased evidence, and when

Source

The organisation's users and the service itself.

Recipients

Cloudflare, Inc.: platformSub-processorHosting and invitation emails.Location: Cloudflare's global network; processing can take place in any Cloudflare location. No data-location restriction is set today. Evidence and report storage is moving to EU-jurisdiction R2 buckets (planned).
PlanetScale, Inc.Sub-processorStores the audit log and memberships.Location: AWS eu-west-1 (Ireland), for staging and production.

International transfers

Retention

Audit log: the period the organisation sets, from 30 days up to its plan's bound; 365 days if it has not set one. A daily job deletes older rows.
Evidence access log and memberships: for the life of the organisation.
When an owner deletes an organisation it closes at once and its data is permanently deleted 30 days later; a record that the deletion happened (id, slug and counts, no content) is kept.

Security measures

Encryption in transit and at rest, tenant isolation with row-level security, role-based access and an append-only audit log. Deleting an organisation needs a recent password or authenticator confirmation. Trust centre.

Billing, referrals and revenue records

Purpose

Charge for subscriptions, issue invoices and refunds, give referral credit, keep accounting records and report the business's revenue.

Lawful basis

Contract (Article 6(1)(b)); legal obligation (Article 6(1)(c)) for accounting records; legitimate interests (Article 6(1)(f)) for the referral programme and revenue reporting.

Legitimate interest: Running a referral programme organisations choose to join, preventing self-referral, and managing the business's finances. The referring organisation sees counts only.

Data subjects

Billing contacts
Owners of referred and referring organisations
ScoutSentinel administrators

Personal data

Billing contact name, email and purchase-order reference; organisation name
Invoices, payments, refunds, credit notes, disputes and subscription status
Which organisation referred which, the card fingerprint Stripe returns (never the card number) and the new owner's email domain, used to stop self-referral
An optional cancellation reason, kept by us and not sent to Stripe
Revenue figures with the organisation's name; the administrator's email and reason on an exchange-rate override

Source

The billing contact, Stripe and the service.

Recipients

Stripe Payments Australia Pty Ltd and its affiliatesSub-processorStripe Managed Payments: Stripe collects payment details (we never receive full card numbers), charges as merchant of record and handles applicable indirect taxes and payment support.Location: Global; Stripe can transfer data to Stripe, LLC in the United States.
Stripe and its affiliatesIndependent controllerFor their own payment, fraud prevention and regulatory purposes; see Stripe's privacy policy.
PlanetScale, Inc.Sub-processorStores billing records and the billing archive.Location: AWS eu-west-1 (Ireland), for staging and production.
Cloudflare, Inc.: platformSub-processorHosting and billing emails.Location: Cloudflare's global network; processing can take place in any Cloudflare location. No data-location restriction is set today. Evidence and report storage is moving to EU-jurisdiction R2 buckets (planned).

International transfers

Stripe: processed globally, including by Stripe, LLC in the United States; the Stripe DPA, part of the Stripe Services Agreement (EU standard contractual clauses with the UK Addendum, and the Data Privacy Framework). Cloudflare runs on a global network and can process data in any Cloudflare location; no data-location restriction is set today. Safeguard: the Cloudflare Data Processing Addendum, part of Cloudflare's terms (EU standard contractual clauses with the UK Addendum, and the Data Privacy Framework with the UK Extension). PlanetScale: staging and production databases in AWS eu-west-1 (Ireland). Safeguard: the PlanetScale DPA, part of its terms (EU standard contractual clauses and UK controller-to-processor clauses).

Retention

Billing records while the organisation exists; after it is deleted, in a restricted archive available to authorised administrators, with access recorded, for six years after the financial-year end used by our accounting schedule, then deleted by a daily job.
Revenue figures on the same six-year rule, kept after the organisation is deleted so reported history does not change.
Referral records while the referring organisation exists.

Security measures

Encryption in transit and at rest, tenant isolation with row-level security, role-based access and an append-only audit log. Card data is held by Stripe only. Each read of the billing archive is recorded with a reason. Trust centre.

Support and email correspondence

Purpose

Answer enquiries, support requests, assessment requests, privacy and security reports sent to our addresses.

Lawful basis

Legitimate interests (Article 6(1)(f)); contract (Article 6(1)(b)) for customers.

Legitimate interest: Replying to people who write to us. We keep only what they send and our replies.

Data subjects

Anyone who emails us
Customer users

Personal data

Name, email address and anything included in the message

Source

The sender.

Recipients

Cloudflare, Inc.: platformSub-processorEmail Routing receives mail for our addresses and forwards it to our business inbox.Location: Cloudflare's global network; processing can take place in any Cloudflare location. No data-location restriction is set today. Evidence and report storage is moving to EU-jurisdiction R2 buckets (planned).
Microsoft Corporation: Microsoft 365Sub-processorOur business inbox.Location: Mailbox content is stored at rest in Australia, our tenant's geography; Microsoft can process other data elsewhere.

International transfers

Cloudflare runs on a global network and can process data in any Cloudflare location; no data-location restriction is set today. Safeguard: the Cloudflare Data Processing Addendum, part of Cloudflare's terms (EU standard contractual clauses with the UK Addendum, and the Data Privacy Framework with the UK Extension). Microsoft 365: mailbox content stored at rest in Australia, our tenant's geography; safeguard: the Microsoft Products and Services Data Protection Addendum, part of its terms (EU standard contractual clauses with the UK Addendum, and the Data Privacy Framework).

Retention

We keep support conversations for 2 years after they are closed, then delete them.

Security measures

Mail for our addresses is received through Cloudflare Email Routing with SPF, DKIM and DMARC on our domain. Trust centre.

Service and trial guidance emails

Purpose

Send account, security, billing and alert emails, and, during a trial, guidance about the organisation's own set-up.

Lawful basis

Contract (Article 6(1)(b)) for account, security and billing emails; legitimate interests (Article 6(1)(f)) for trial guidance.

Legitimate interest: Helping a trial organisation reach its first working check. Limited to two topics a week; anyone can switch them off in Settings > Security or with the unsubscribe button.

Data subjects

Owners and admins of organisations
Customer users

Personal data

Email address and name
Which guidance email was queued, when the provider accepted it and the accepted recipient count (not the addresses)
Each person's choice to switch trial emails off

Source

The account and the organisation's configuration.

Recipients

Cloudflare, Inc.: platformSub-processorEmail Service sends the messages.Location: Cloudflare's global network; processing can take place in any Cloudflare location. No data-location restriction is set today. Evidence and report storage is moving to EU-jurisdiction R2 buckets (planned).
PlanetScale, Inc.Sub-processorStores delivery records and preferences.Location: AWS eu-west-1 (Ireland), for staging and production.

International transfers

Retention

Email delivery records while the organisation exists; the trial-email preference for the life of the account.
The administrators' email log (kind, recipient, status and sending administrator, not the body) for 90 days.

Security measures

Encryption in transit and at rest, tenant isolation with row-level security, role-based access and an append-only audit log. Sending domains are signed with SPF, DKIM and DMARC. Trust centre.

Platform security and abuse prevention

Purpose

Tell people from bots on our forms, limit request rates, stop credential guessing and protect accounts, evidence and the platform.

Lawful basis

Legitimate interests (Article 6(1)(f)).

Legitimate interest: Preventing abuse of forms, sign-in and paid resources. Rate-limit counters hold short-lived keys and expire within a day.

Data subjects

People submitting the waitlist or sign-up forms
Website, app and API users

Personal data

Turnstile: IP address, user agent, TLS fingerprint and browser signals
Rate-limit keys built from the IP address (IPv6 by its /64 prefix) or a fixed-length hash of an email address, with hit times
Sign-in attempts and second-factor attempts per account

Source

The visitor's browser and requests.

Recipients

Cloudflare, Inc.: TurnstileSub-processorRuns the bot check.Location: Cloudflare's network.
CloudflareIndependent controllerWhen it uses Turnstile signals to improve its bot detection; see Cloudflare's Turnstile privacy addendum.
Cloudflare, Inc.: platformSub-processorHolds rate-limit counters in Durable Objects.Location: Cloudflare's global network; processing can take place in any Cloudflare location. No data-location restriction is set today. Evidence and report storage is moving to EU-jurisdiction R2 buckets (planned).

International transfers

Retention

Rate-limit state: until its window expires, at most 24 hours, then removed.
Sign-in attempts: 90 days (see accounts).
Turnstile signals: under Cloudflare's own terms.

Security measures

Limits refuse requests when the counter store is unavailable for anonymous, credential and cost-bearing routes. Trust centre.

Server error reporting and platform operations records

Purpose

Find and fix faults in our servers and background jobs, and make sure queued work is delivered or investigated.

Lawful basis

Legitimate interests (Article 6(1)(f)).

Legitimate interest: Running a reliable service. Error reports carry no message, URL, user or organisation; operations records hold identifiers and hashes, not content.

Data subjects

Customer users and waitlist entrants whose requests or jobs fail

Personal data

Server error reports: error type, a code, the route pattern, a request id, the environment and the release
Dead letters: ids and a hash of the failed message
Job heartbeats (no personal data)

Source

Our API and background jobs.

Recipients

PostHog Inc.Sub-processorServer error reports go directly to PostHog's EU service (eu.i.posthog.com). This reporting is separate from analytics consent.Location: PostHog EU Cloud (AWS, Germany); PostHog also processes data outside the EU, including in the United States. Browser events use our proxy p.scoutsentinel.com, API error reports go directly to eu.i.posthog.com.
Cloudflare, Inc.: platformSub-processorPlatform logs.Location: Cloudflare's global network; processing can take place in any Cloudflare location. No data-location restriction is set today. Evidence and report storage is moving to EU-jurisdiction R2 buckets (planned).
PlanetScale, Inc.Sub-processorStores dead letters and heartbeats.Location: AWS eu-west-1 (Ireland), for staging and production.

International transfers

PostHog EU Cloud (AWS, Germany), with processing also in the United States; PostHog DPA signed 22 October 2026. Cloudflare runs on a global network and can process data in any Cloudflare location; no data-location restriction is set today. Safeguard: the Cloudflare Data Processing Addendum, part of Cloudflare's terms (EU standard contractual clauses with the UK Addendum, and the Data Privacy Framework with the UK Extension). PlanetScale: staging and production databases in AWS eu-west-1 (Ireland). Safeguard: the PlanetScale DPA, part of its terms (EU standard contractual clauses and UK controller-to-processor clauses).

Retention

Dead letters: 90 days after they are resolved; open ones 180 days after their last delivery; and with the organisation.
Job heartbeats: 14 days.
Error events: PostHog keeps events for the retention period of our PostHog plan (1 year on its free plan, 7 years on paid plans); it has no shorter setting.
Cloudflare keeps these logs for 7 days and then deletes them.

Security measures

Encryption in transit and at rest, tenant isolation with row-level security, role-based access and an append-only audit log. Trust centre.

Public website and domain intelligence (discovery)

Purpose

For the domains our customers monitor, inventory public web pages, certificates, DNS and domain registration; find connected domains, lookalikes and public technical risks; and suggest journeys to monitor.

Lawful basis

Legitimate interests (Article 6(1)(f)); individuals can object.

Legitimate interest: Identifying monitored organisations' public web estate and technical risks for their own assurance, balanced against individuals' privacy: pages are read the way a search engine does, facts are kept rather than pages, and personal contact details are reduced as described here.

Data subjects

People whose role mailbox address or business phone number is published on a crawled site (usually organisations, occasionally identifiable staff)
Domain registrants, where a registrant organisation field names a person or sole trader
Owners of public GitHub accounts linked from crawled pages

Personal data

Page facts: address, title, status, scripts, frames and third-party services, form destinations and whether a form has a password field, security headers, link addresses and short link texts with email addresses, phone numbers and long digit runs removed
Business phone numbers with a department label from a fixed list (numbers marked up as a person's are skipped)
Role mailbox addresses such as info@ or support@; for any other email address, only its domain
Domain registration: registrar, dates, status, nameservers, DNSSEC and the registrant organisation (often redacted); registrant contact details are not read or stored
Certificate names from certificate transparency logs; DNS records
Public GitHub repository metadata linked from a monitored site (not code, README bodies or contributor details)
Carrier and line type of published business phone numbers (subscriber identity is not requested)

Source

Public web pages (read by ScoutSentinelBot, which honours robots.txt and Content Signals), certificate transparency logs, public DNS, WHOIS and RDAP, and the public sources listed.

Recipients

Cloudflare, Inc.: platformSub-processorRuns the crawler and renders public pages (Browser Run).Location: Cloudflare's global network; processing can take place in any Cloudflare location. No data-location restriction is set today. Evidence and report storage is moving to EU-jurisdiction R2 buckets (planned).
PlanetScale, Inc.Sub-processorStores crawl facts and discovery records.Location: AWS eu-west-1 (Ireland), for staging and production.
APIVerve (EvlarSoft LLC)Sub-processorReceives registrable domain names for WHOIS.Location: United States.
SSLMate (Cert Spotter) and crt.sh (Sectigo)Sub-processorReceive monitored domain names.Location: United States and United Kingdom.
Cloudflare DNS (1.1.1.1) and Google Public DNSSub-processorReceive domain and host names.Location: Global anycast.
Google LLC: Web Risk APISub-processorPlanned, not yet in useReceives each monitored domain's homepage URL once a day, when the platform key is configured.Location: Any country where Google or its sub-processors have facilities.
Twilio Inc.Sub-processorWith a configured Twilio account, receives business phone numbers already published on verified customer websites, for carrier and line type.Location: United States: Twilio's default US1 region, which all our Twilio requests use.
Anthropic, PBCSub-processorWhen AI features are on, receives filtered crawl facts to suggest journeys (never page bodies or phone digits); see AI-assisted features.Location: Stored in the United States; Anthropic can route requests to the United States, Europe, Asia and Australia.
IANA (data.iana.org) and registry RDAP endpointsPublic source (not a sub-processor)Domain names.
HSTS preload listPublic source (not a sub-processor)A registrable domain name, at most weekly.
Common Crawl URL indexPublic source (not a sub-processor)The monitored domain name.
GitHub public REST APIPublic source (not a sub-processor)Domain names and linked public account or repository identifiers.
Apple (itunes.apple.com lookup API) and Google PlayPublic source (not a sub-processor)The public id of a linked app.
NVD CVE APIPublic source (not a sub-processor)Product names and versions, never a host name.
endoflife.date API v1Public source (not a sub-processor)An allow-listed product name.
CISA Known Exploited Vulnerabilities cataloguePublic source (not a sub-processor)Nothing sent.
retire.js repositoryPublic source (not a sub-processor)Nothing sent.
abuse.ch SSLBLPublic source (not a sub-processor)Nothing sent.

International transfers

Providers in the United States and the United Kingdom receive domain names, which are not normally personal data; mechanisms are shown for each provider. Twilio: United States, under the Twilio Data Protection Addendum (Data Privacy Framework, binding corporate rules, then standard contractual clauses). Cloudflare runs on a global network and can process data in any Cloudflare location; no data-location restriction is set today. Safeguard: the Cloudflare Data Processing Addendum, part of Cloudflare's terms (EU standard contractual clauses with the UK Addendum, and the Data Privacy Framework with the UK Extension).

Retention

Public crawl facts: each site's latest crawl, until the next replaces it; deleted by a daily job once more than 90 days old and no customer's crawl record has named the site for 90 days. App store listings likewise.
Shared public observations (DNS, TLS, certificate transparency, HTTP) and their shared evidence: 90 days, then deleted by a daily job; one an organisation reused is kept until that reuse is 90 days old.
Phone carrier answers are reused for up to 30 days (unavailable answers retried after one day); GitHub and endoflife.date answers are cached for 24 hours; HSTS preload answers for a week.
Results kept for a customer (suggested domains, registration facts, findings) follow the organisation's data retention and deletion process.

Security measures

Requests are signed as ScoutSentinelBot; the crawler sends no cookies or credentials and submits nothing. Shared crawl facts are not linked to any customer. Trust centre.

Public register intelligence (companies, trade marks, notices and sanctions)

Purpose

Identify a customer's own legal entities, group and trade marks, and show public notices, tribunal decisions and sanctions designations that name them.

Lawful basis

Legitimate interests (Article 6(1)(f)); individuals can object.

Legitimate interest: Showing organisations public facts about their own companies and brands. Registers are imported as whole files; records about individuals are discarded where the source allows, and we keep entities only for notices and sanctions.

Data subjects

Companies and other legal persons on public registers
Sole traders on the Australian Business Register and individual trade mark owners or applicants

Personal data

Company records: number, names, status, dates, registered-office postcode and industry codes; corporate controllers only (individual people-with-significant-control records are discarded before storage)
Legal Entity Identifier records and relationships
Trade marks: number, text, status, dates, classes and owner or applicant name, country and postcode, and for some sources such as USPTO a published address
ABR and ASIC records, which can identify sole traders
Gazette corporate notices only: company number and name, notice date, issue and type (notices about individuals are not kept, and no individual's name is stored)
Employment tribunal decisions naming a customer's own company: GOV.UK id, the company's name as written, side, case numbers, categories, country and dates (the claimant's name, the decision's title and its page are not stored)
CMA, SFO and product safety notices that name an organisation: title, page address, dates, type and the organisations named (a case title naming a person by an honorific is not stored)
UK Sanctions List designated entities: identifier, regime, names, UK company numbers and dates (designated individuals and ships are discarded)

Source

Public registers and publications, listed as recipients below.

Recipients

Cloudflare, Inc.: platformSub-processorRuns the imports and stages files during a load.Location: Cloudflare's global network; processing can take place in any Cloudflare location. No data-location restriction is set today. Evidence and report storage is moving to EU-jurisdiction R2 buckets (planned).
PlanetScale, Inc.Sub-processorStores register records.Location: AWS eu-west-1 (Ireland), for staging and production.
Companies House bulk downloadsPublic source (not a sub-processor)Nothing sent.
GLEIF Golden CopyPublic source (not a sub-processor)Nothing sent.
UK Intellectual Property OfficePublic source (not a sub-processor)Nothing sent.
USPTO Open Data PortalPublic source (not a sub-processor)Our API key only.
Australian Business Register and ASICPublic source (not a sub-processor)Nothing about customers sent.
IP Australia Trade Marks bulk dataPublic source (not a sub-processor)Supported once the supplier dataset is acquired.
The GazettePublic source (not a sub-processor)A publication date, page number and public notice ids.
GOV.UK search APIPublic source (not a sub-processor)The customer's own company's registered name.
GOV.UK search and content APIsPublic source (not a sub-processor)Nothing about a customer.
UK Sanctions ListPublic source (not a sub-processor)Nothing sent.

International transfers

No personal data is sent to the publishers. Cloudflare runs on a global network and can process data in any Cloudflare location; no data-location restriction is set today. Safeguard: the Cloudflare Data Processing Addendum, part of Cloudflare's terms (EU standard contractual clauses with the UK Addendum, and the Data Privacy Framework with the UK Extension). PlanetScale: staging and production databases in AWS eu-west-1 (Ireland). Safeguard: the PlanetScale DPA, part of its terms (EU standard contractual clauses and UK controller-to-processor clauses).

Retention

Register records are updated by later imports; historical names, inactive entities, trade mark metadata and corporate Gazette notices can remain. A record that leaves its register (missing from a complete file, or reported by the register as dead, retired or cancelled) is deleted 2 years later; it is kept if it returns.
Tribunal decisions: replaced at each daily check; deleted when the company is removed from the organisation, and with the organisation.
GOV.UK notices and sanctions designations: refreshed daily; one the publisher no longer lists is removed after the next complete read. Matches with a customer's companies are worked out when a page is shown and are not stored.

Security measures

Encryption in transit and at rest, tenant isolation with row-level security, role-based access and an append-only audit log. Reuse follows each source's licence (Open Government Licence v3.0, CC0, public domain, CC BY 3.0 AU, or the IP Australia agreement). Trust centre.

Competitor watch

Purpose

Let a customer follow public, passive facts about companies it names as competitors: new certificates, DNS and email providers, domain registration changes, and trade marks and notices from registers we already hold.

Lawful basis

Legitimate interests (Article 6(1)(f)); individuals can object.

Legitimate interest: A customer's interest in awareness of its market, balanced against the competitor's: the competitor's own servers are not contacted, lookups go to third-party providers only, and facts are about companies and domains, not people.

Data subjects

Competitor companies (legal persons)
A sole trader or person, where a domain's registrant organisation field, a certificate name or a trade mark owner names them
The customer user who added the competitor

Personal data

Competitor name, the register and register id the customer picked (Companies House, GLEIF, ABR or ASIC) and up to three registrable domains
Certificate transparency facts for those domains
Public DNS: identified providers, nameservers and mail servers (TXT records are not stored)
Domain registration: registrar, created, updated and expiry dates and the registrant organisation; personal contact details are not stored
Trade marks, Gazette notices, GOV.UK notices and UK sanctions designations matching the competitor's company, read from platform-held registers when a page is shown and not stored
The id of the user who added the competitor

Source

The customer names the competitor; certificate logs, DNS over HTTPS resolvers, WHOIS (APIVerve) or an approved RDAP service, and our own register tables.

Recipients

SSLMate (Cert Spotter) and crt.sh (Sectigo)Sub-processorReceive the competitor's domain names.Location: United States and United Kingdom.
Cloudflare DNS (1.1.1.1) and Google Public DNSSub-processorReceive the competitor's domain and host names.Location: Global anycast.
APIVerve (EvlarSoft LLC)Sub-processorReceives the competitor's registrable domain names.Location: United States.
IANA (data.iana.org) and registry RDAP endpointsPublic source (not a sub-processor)Domain names, where an approved RDAP service is used.
Cloudflare, Inc.: platformSub-processorRuns the checks.Location: Cloudflare's global network; processing can take place in any Cloudflare location. No data-location restriction is set today. Evidence and report storage is moving to EU-jurisdiction R2 buckets (planned).
PlanetScale, Inc.Sub-processorStores competitors and snapshots, private to the organisation.Location: AWS eu-west-1 (Ireland), for staging and production.

International transfers

Providers receive domain names, which are not normally personal data; locations and mechanisms as shown for each provider. Cloudflare runs on a global network and can process data in any Cloudflare location; no data-location restriction is set today. Safeguard: the Cloudflare Data Processing Addendum, part of Cloudflare's terms (EU standard contractual clauses with the UK Addendum, and the Data Privacy Framework with the UK Extension). PlanetScale: staging and production databases in AWS eu-west-1 (Ireland). Safeguard: the PlanetScale DPA, part of its terms (EU standard contractual clauses and UK controller-to-processor clauses).

Retention

Checked once a day; "Check now" at most once an hour. A snapshot is written only when the facts or the outcome change.
Snapshots older than 400 days are deleted at the next check, except the latest for each domain and kind.
A removed competitor stops being checked; its records are deleted with the organisation.
Allowance per plan: 3 competitors on Starter, 10 on Team, 25 on Business and 50 on Enterprise.

Security measures

Encryption in transit and at rest, tenant isolation with row-level security, role-based access and an append-only audit log. The check's network path can reach the fixed provider hosts alone; a test asserts no request goes to the competitor's domain. Trust centre.

Customer relationship and pilot feedback

Purpose

Manage pilots and the customer relationship, and judge whether monitoring evidence is useful to customers.

Lawful basis

Legitimate interests (Article 6(1)(f)).

Legitimate interest: Supporting customers and improving the product. Feedback answers are a yes or no with an optional reason code from a fixed list; health signals are computed on request and not stored.

Data subjects

Customer users and contacts named in administrators' notes
ScoutSentinel administrators

Personal data

Administrators' notes about a customer organisation (free text that may name people), their author and times; not shown to the customer
A user's yes or no answer and optional reason code on an Event or report run

Source

ScoutSentinel administrators and customer users.

Recipients

PlanetScale, Inc.Sub-processorStores notes and answers.Location: AWS eu-west-1 (Ireland), for staging and production.
Cloudflare, Inc.: platformSub-processorHosting.Location: Cloudflare's global network; processing can take place in any Cloudflare location. No data-location restriction is set today. Evidence and report storage is moving to EU-jurisdiction R2 buckets (planned).

International transfers

Retention

Notes: for the life of the organisation, and deleted with it. A note that names a person can be edited or deleted on request.
Feedback answers: deleted with the organisation, with the Event or report run, and when the user's account row is deleted.

Security measures

Encryption in transit and at rest, tenant isolation with row-level security, role-based access and an append-only audit log. Notes are readable by platform administrators alone. Trust centre.

Account erasure and analytics deletion

Purpose

Carry out a user's deletion of their own account, and the erasure of accounts left without an organisation, including their analytics data.

Lawful basis

Legal obligation (Article 6(1)(c)) to act on erasure requests; contract (Article 6(1)(b)) for self-service deletion.

Data subjects

Customer users who delete their account or whose last organisation is deleted

Personal data

The account (id, email, name, avatar) and its sign-in material
A record in each organisation's audit log that a member deleted their account
The user's PostHog person and its analytics events

Source

The user's request, or the deletion of their last organisation.

Recipients

PostHog Inc.Sub-processorReceives the deletion request for the person and its events through its EU service.Location: PostHog EU Cloud (AWS, Germany); PostHog also processes data outside the EU, including in the United States. Browser events use our proxy p.scoutsentinel.com, API error reports go directly to eu.i.posthog.com.
PlanetScale, Inc.Sub-processorStores the account.Location: AWS eu-west-1 (Ireland), for staging and production.

International transfers

PostHog EU Cloud (Frankfurt). PlanetScale: staging and production databases in AWS eu-west-1 (Ireland). Safeguard: the PlanetScale DPA, part of its terms (EU standard contractual clauses and UK controller-to-processor clauses).

Retention

The password, linked sign-ins, sessions, recovery codes, authenticator secret, sign-in links, OAuth grants, sign-in attempts and memberships are deleted.
The account row is deleted when nothing refers to it; if audit or evidence-access records name the user, it is kept as an id with the name "Deleted user" and an address that cannot receive mail. Those records expire under each organisation's audit-log retention.
If PostHog deletion cannot be done automatically, it is recorded and completed by hand; account deletion does not wait for it.

Security measures

Deletion needs the password or an authenticator code and the account's email address typed in. Trust centre.

Part B: processing as processor

Article 30(2). Processing we carry out on each customer's documented instructions. The customer is the controller; its data processing agreement and settings govern this processing.

Processor summary
Controllers we act for	Each customer organisation, for the content it puts into the service or instructs us to capture. Customer organisations are recorded in our platform database and can be named to a supervisory authority on request.
Special category data	Not intended. Customers agree not to use real health or other special category data and to use synthetic identities.
Retention	Follows each customer's plan and settings, within the bounds stated in each record; see data retention.

Customer journeys and evidence

Purpose

Run the journeys and checks each customer configures against its own services, evaluate assertions, and keep the evidence behind each result.

Categories of processing

Running HTTP, API, DNS and browser probes on the customer's schedule
Capturing, redacting, hashing and storing evidence; evaluating assertions; producing Events and reports
Holding test credentials and secrets the customer provides so probes can complete a journey

Data subjects

Test identities the customer configures (synthetic identities are required)
People whose data appears on the customer's pages during a check
Customer users

Personal data

Test identities and secrets (envelope-encrypted)
Screenshots, page HTML, network archives (HAR), traces and response bodies
Browser video or session recordings, where enabled and supported
Observations, step and assertion results

Recipients

Cloudflare, Inc.: platformSub-processorCompute, browser checks (Browser Run) and evidence storage (R2). With full network capture, Browser Run keeps its own session recording for 30 days.Location: Cloudflare's global network; processing can take place in any Cloudflare location. No data-location restriction is set today. Evidence and report storage is moving to EU-jurisdiction R2 buckets (planned).
PlanetScale, Inc.Sub-processorObservations, Events and evidence metadata.Location: AWS eu-west-1 (Ireland), for staging and production.
Public report linksCustomer-enabled destinationA report the customer publishes is available to people with the link.

International transfers

Retention

Evidence: the period the customer sets, from 1 day to its plan maximum (currently 30 days on Starter, 365 on Team, 730 on Business and 1,095 on Enterprise); the plan maximum if not set. Report artefacts follow it.
Observations: 7 days up to four times the plan's evidence maximum; the evidence maximum if not set. Observations that evidence or an open Event depends on, and each Watch's latest, are kept longer.
Evidence records (hash, size, capture time) remain after the object expires or is erased, for the life of the organisation.
Shared public observations from DNS, TLS, certificate transparency and HTTP metadata probes: 90 days (see discovery). Browser, API, voice and email probes are not shared.
All of it is permanently deleted 30 days after the organisation is deleted, except the signed hourly ledger checkpoints, which hold hashes only.

Security measures

Known secret values are removed from text evidence before storage; fields filled from secrets, password, one-time-code and card fields and marked elements are masked in screenshots. Video is not masked frame by frame. Evidence is hashed into a signed ledger; downloads use short-lived tokens with an access log row. Trust centre.

Telephone checks: call recordings and transcripts

Purpose

Place the telephone checks a customer configures, usually to its own contact centre or phone menu, and record and transcribe them as evidence.

Categories of processing

Placing calls and playing configured inputs
Recording, transcribing and redacting calls; evaluating what was heard

Data subjects

People who answer a telephone check
The customer's contact-centre staff

Personal data

Caller and destination numbers, call identifiers, timing and provider events
Call audio, including the voice of anyone who answers, and transcripts

Recipients

Vonage Business Inc.Sub-processorProgrammable voice; keeps its own recording copy for 30 days.Location: United States: calls use Vonage's global API endpoint, which sets them up in Virginia. Vonage hosts its platform and call recordings on AWS in the United States, the EU, Australia and Singapore.
Google LLC, through Vonage speech recognitionSub-processorSpeech recognition for Vonage calls.Location: United States.
Twilio Inc.Sub-processorWhen selected for calls, with a platform or customer-connected account.Location: United States: Twilio's default US1 region, which all our Twilio requests use.
Cloudflare, Inc.: Workers AI (Whisper)Sub-processorTranscribes recordings without a usable provider transcript, from raw audio.Location: Cloudflare's network; Cloudflare names no specific location.
Cloudflare, Inc.: platformSub-processorStores audio and transcripts as evidence.Location: Cloudflare's global network; processing can take place in any Cloudflare location. No data-location restriction is set today. Evidence and report storage is moving to EU-jurisdiction R2 buckets (planned).
The customer's own Vonage or Twilio accountCustomer-enabled destinationIf the customer connects one.

International transfers

Vonage: calls set up in the United States, recordings hosted on AWS in the United States, the EU, Australia or Singapore; Vonage DPA (Data Privacy Framework, then standard contractual clauses). Google through Vonage: United States, under Vonage's DPA. Twilio: United States, under the Twilio Data Protection Addendum. Cloudflare runs on a global network and can process data in any Cloudflare location; no data-location restriction is set today. Safeguard: the Cloudflare Data Processing Addendum, part of Cloudflare's terms (EU standard contractual clauses with the UK Addendum, and the Data Privacy Framework with the UK Extension).

Retention

Raw call audio: 7 days by default; the customer can set 1 to 90 days, never longer than its evidence period.
Transcripts: the evidence period.
Vonage keeps its own recording copy for 30 days, with no earlier deletion operation. After downloading a Twilio recording we request deletion of Twilio's copy; Twilio documents 40 days of recording-metadata retention after deletion.

Security measures

Unless the customer attests that it has arranged notice and consent, calls begin with a spoken recording and transcription notice. Known secret values and recognised patterns are removed from stored transcripts; names and addresses are not reliably recognised. Voice is not used to identify anyone. Trust centre.

Email probes

Purpose

Send and receive the test emails a customer's journeys require, such as sign-up confirmations, and check their delivery and content.

Categories of processing

Sending probe emails to verified recipients through a fixed template
Receiving mail at the organisation's probe mailbox, matching it to a run and storing redacted evidence

Data subjects

Test identities
Senders of mail to a probe mailbox

Personal data

Sender, recipient, subject, authentication results and message content of probe mail

Recipients

Cloudflare, Inc.: platformSub-processorEmail Service and Email Routing send and receive probe mail; evidence storage.Location: Cloudflare's global network; processing can take place in any Cloudflare location. No data-location restriction is set today. Evidence and report storage is moving to EU-jurisdiction R2 buckets (planned).

International transfers

Retention

Each mailbox's list of received messages: 30 days unless the customer sets 1 to 365 days.
Stored messages are evidence and follow the evidence period.

Security measures

Probe mail uses a separate signed sending domain. The mailbox address is unguessable. Known secret values are redacted before storage. Trust centre.

AI-assisted features

Purpose

When AI features are on: build and repair Watches, explain Events, judge materiality and summarise changes, suggest journeys and help define business services.

Categories of processing

Sending filtered text to a language model and showing its suggestions for the customer to accept or reject

Data subjects

Customer users
People whose data appears in monitored page excerpts or results

Personal data

Watch plans and definitions, with every stored secret value replaced by [REDACTED]
Step and assertion results, error messages and before-and-after diffs
Excerpts of monitored pages (visible text up to 8,000 characters and HTML up to 20,000 characters per page, scripts, styles, comments and event handlers removed)
The instruction typed into the builder; for service definition, the conversation, current form values and member and journey names with internal ids replaced by temporary references

Recipients

Anthropic, PBCSub-processorModel inference.Location: Stored in the United States; Anthropic can route requests to the United States, Europe, Asia and Australia.
Cloudflare, Inc.: AI GatewaySub-processorRoutes requests; our configuration disables prompt-content logging, subject to the provider account settings.Location: Cloudflare's network.
Cloudflare, Inc.: platformSub-processorHolds the builder's working state in Durable Objects.Location: Cloudflare's global network; processing can take place in any Cloudflare location. No data-location restriction is set today. Evidence and report storage is moving to EU-jurisdiction R2 buckets (planned).

International transfers

Anthropic: stored in the United States, with requests routed to the United States, Europe, Asia or Australia; the Anthropic DPA, part of its Commercial Terms (EU standard contractual clauses with the UK Addendum). Cloudflare runs on a global network and can process data in any Cloudflare location; no data-location restriction is set today. Safeguard: the Cloudflare Data Processing Addendum, part of Cloudflare's terms (EU standard contractual clauses with the UK Addendum, and the Data Privacy Framework with the UK Extension).

Retention

Builder working state: deleted 24 hours after its last change; previews after 1 hour.
AI explanations and materiality reasoning are kept with their Event.
Anthropic's standard commercial API retention is up to 30 days, with exceptions for legal requirements, policy enforcement, separately agreed retention and features with their own retention. Commercial API data is not used for training by default.

Security measures

Every string passes two filters first: the organisation's known secret values are removed, then email addresses, UK and US phone numbers, card numbers, UK postcodes, UK National Insurance numbers and long digit runs are replaced. Names, street addresses and dates of birth are not reliably recognised. We do not send screenshots, HAR files, call audio or recordings to Anthropic. Trust centre.

Integrations and notifications

Purpose

Deliver alerts, Event updates, reports and metrics to the people and destinations the customer configures.

Categories of processing

Sending alert emails to the customer's chosen recipients
Sending Event information to the integrations and signed webhooks the customer enables
Exporting metrics to the customer's OpenTelemetry collector

Data subjects

Customer users and other alert recipients the customer chooses

Personal data

Recipient email addresses
Event information configured for each destination

Recipients

Cloudflare, Inc.: platformSub-processorEmail Service sends alert emails.Location: Cloudflare's global network; processing can take place in any Cloudflare location. No data-location restriction is set today. Evidence and report storage is moving to EU-jurisdiction R2 buckets (planned).
PlanetScale, Inc.Sub-processorStores integration settings (credentials envelope-encrypted).Location: AWS eu-west-1 (Ireland), for staging and production.
Slack, PagerDuty, incident.io, Jira Service Management, GitHub and signed webhooksCustomer-enabled destinationThe customer's own vendors; they receive what the customer asks us to send.
The customer's OpenTelemetry collectorCustomer-enabled destinationMetrics export.

International transfers

Destinations the customer enables are its own choice. Cloudflare runs on a global network and can process data in any Cloudflare location; no data-location restriction is set today. Safeguard: the Cloudflare Data Processing Addendum, part of Cloudflare's terms (EU standard contractual clauses with the UK Addendum, and the Data Privacy Framework with the UK Extension).

Retention

Integration settings until the customer removes them or the organisation is deleted.
Webhook delivery keys used to ignore duplicate provider callbacks: 7 days.

Security measures

Webhooks are signed; integration credentials are envelope-encrypted per organisation. Trust centre.

Optional search, business-profile and review monitoring (planned)

Purpose

When platform credentials are configured and an organisation administrator enables and approves them: brand-search results, public business-profile comparisons, review themes and search-traffic suggestions.

Categories of processing

Sending approved public identifiers and search terms to the provider
Deriving review ratings, dates and complaint themes in memory

Data subjects

Reviewers and sole traders named in returned public records

Personal data

Returned public business details and review samples; we keep hashed review and profile identifiers, source, ratings, dates and derived themes, not reviewer names, avatars, raw review text or owner replies

Recipients

DataForSEOSub-processorOptional: used only when platform credentials are configured and an organisation administrator enables the lookups. DataForSEO publishes API task-data retention of 365 days.Location: DataForSEO's servers include Hetzner in Germany; its own sub-processors include Google and Microsoft Azure in the United States.
PlanetScale, Inc.Sub-processorStores derived records, private to the organisation.Location: AWS eu-west-1 (Ireland), for staging and production.

International transfers

DataForSEO OÜ (Estonia): servers include Hetzner in Germany, with sub-processors in the United States; its DPA, part of its terms where the GDPR applies, uses EU standard contractual clauses.

Retention

Review history: up to 200 derived records per monitored domain; records older than 90 days since observation are excluded when read and pruned on refresh.
Other discovery records follow the organisation's deletion process.

Security measures

Encryption in transit and at rest, tenant isolation with row-level security, role-based access and an append-only audit log. Trust centre.