Data and subprocessors
Plain answers to the questions a security or legal team asks before buying a scanning service.
What we store
- Telegram identity — your numeric Telegram ID, username and first name, so the bot knows whose scans are whose.
- Scan targets — the URLs and hostnames you submit.
- Scan results — findings, severities, evidence snippets, security score and timestamps.
- Billing records — plan, amount, payment charge ID and date. We never see or store card numbers.
- Technical logs — errors and timing, kept for diagnostics.
We do not store passwords of your application, session cookies of your users, or any data behind a login. A scan never authenticates into your app.
Why we store it
- To run the scan and show the report.
- To keep scan history, compare runs and detect regressions.
- To answer support requests and refund a scan that failed technically.
- To prevent abuse — daily limits and cooldowns are enforced from these records.
- To keep accounting records required by law.
We do not sell data, do not share it for advertising, and do not use your scan results to train models.
Where it lives
Application data (database) is stored on a server located in Kazakhstan, operated by DeployGuard. The public website is served through Cloudflare's global network.
If your organisation requires data residency in the EU or a signed data processing agreement, tell us before purchasing — we will say honestly whether we can meet it.
Retention
- Scan results — until you ask us to delete them.
- Technical logs — up to 90 days.
- Billing records — for the period required by accounting law.
- Domain verification tokens — while the verification is valid, then rotated.
Deleting your account removes scans, monitors and verification records. Billing records are kept as required by law.
Subprocessors
| Provider | Purpose | Data |
|---|
| Telegram | Bot platform and message delivery | Telegram ID, messages you send to the bot |
| Cloudflare | Website hosting, DNS, email routing | Request metadata, inbound email to support@ |
| Brevo | Outgoing support email | Email addresses, message content |
| Payment provider | Card payments and invoicing | Name, email, billing address, payment status |
We keep this list current. The payment provider is named in the invoice and in the checkout page once card payments go live.
Your rights
You can request access, correction, export or deletion of your data by writing to support@deployguard.app. We answer within 5 business days. If you are in the EU, you also have the right to lodge a complaint with your supervisory authority.
Security of this service
Access to the database is limited to the operator. Secrets are kept in environment variables, never in the repository. The website is served with a strict Content-Security-Policy and no third-party scripts. Payment credentials never reach our servers.
The same scanner is used against our own domain: deployguard.app is scanned regularly and the result is a clean report.
Questions before purchase? support@deployguard.app — we answer in English or Russian.