Privacy Policy & Data Protection

Last Updated: August 27, 2026

1. Introduction & Data Controller

Welcome to RiskShelter ("we", "our", "us", or "the Platform"). RiskShelter provides security intelligence, attack surface management, DNS reconnaissance, and perimeter vulnerability assessment tools.

We are firmly committed to safeguarding personal data, respecting digital privacy, and maintaining transparent data governance in full compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation - GDPR) and Italian Legislative Decree no. 196/2003 (Codice in materia di protezione dei dati personali), as amended by Legislative Decree no. 101/2018.

Data Controller: RiskShelter
Data Protection Inquiries: [email protected]
Security & Abuse Contact: [email protected]

2. Personal Data We Collect

We collect and process only the minimum necessary data to provide our security services, maintain infrastructure integrity, and comply with Italian and European cybersecurity regulations.

2.1 Account & Identity Information

Registration Details: Email address, user name, hashed password, organization/team membership, and assigned roles.
Authentication Identifiers: OAuth tokens (if authenticating via third-party providers such as GitHub or Google).

2.2 Payment & Billing Information

Billing transactions are processed through Stripe, Inc. RiskShelter does not store full credit card numbers, CVVs, or sensitive banking credentials on its servers. We retain only billing references, subscription tiers, transaction IDs, and invoice records required by Italian fiscal and tax laws (D.P.R. 633/1972).

2.3 Scan Targets, Activity Logs & Security Audit Trails

To prevent malicious use, prevent cybercrime, and ensure full forensic accountability:

Scan Inputs: Domains, hostnames, IP addresses, and scan configurations submitted by users.
Audit Logs: Timestamps, originating user IDs, user source IP addresses, browser User-Agent strings, and scan execution results.

3. Legal Bases and Purposes of Processing

Pursuant to Article 6 of the GDPR, RiskShelter processes personal data on the following legal bases:

Purpose of Processing	Categories of Data	Legal Basis (GDPR)
Service Delivery & Account Management	Account details, team memberships, scan results	Art. 6(1)(b) – Performance of a contract
Payment Processing & Invoicing	Billing records, transaction identifiers	Art. 6(1)(b) & (c) – Contractual & Fiscal Legal Obligations
Cybercrime Prevention & Traceability	IP logs, target domains, timestamp audit records	Art. 6(1)(c) & (f) – Legal Obligations & Legitimate Interest for Security
Law Enforcement Cooperation	Full technical audit trails and authorization records	Art. 6(1)(c) – Compliance with legal obligations under Italian Law
Customer Support & Service Communications	Support tickets, email communications	Art. 6(1)(b) – Contract performance

4. Mandatory Scan Authorization & Security Traceability

CRITICAL LEGAL NOTICE: In accordance with Italian Criminal Code (Codice Penale), unauthorized computer system access and cyber reconnaissance against unowned targets is illegal.

Mandatory Authorization: Users are strictly authorized to scan only assets they legally own or have express written authorization to assess.
Immutable Audit Logging: Every scan triggered through RiskShelter is recorded with full cryptographic traceability linking the scan operation to the authenticated user account and originating IP address.
Law Enforcement Cooperation: Under Italian law (including Codice Penale art. 615-ter, 615-quater, 635-bis and Codice di Procedura Penale), RiskShelter will proactively cooperate with the Italian Postal Police (Polizia Postale e delle Comunicazioni), the Judicial Police (Guardia di Finanza / Carabinieri), and European cybercrime agencies. Upon formal legal request or discovery of unauthorized activity, full log records will be made available to authorities.

5. Data Retention & Erasure

We retain personal data only for the period strictly necessary to fulfill the purposes for which it was collected:

Active Accounts: Retained for the duration of your active subscription or account registration.
Audit & Security Connection Logs: Retained for a minimum period of 12 to 24 months in accordance with Italian anti-terrorism and cyber security data retention regulations (Art. 24 Legge 167/2017 and D.Lgs. 196/2003), after which they are permanently purged or anonymized.
Tax & Accounting Records: Retained for 10 years as required by Article 2220 of the Italian Civil Code (Codice Civile).

6. Subprocessors & International Transfers

RiskShelter relies on trusted third-party infrastructure providers who adhere to GDPR standards:

Cloud Hosting & Databases: High-security European/GDPR-compliant infrastructure with encryption at rest and in transit (TLS 1.3 / AES-256).
Payment Processing: Stripe Payments Europe, Ltd. (compliant with PCI-DSS Level 1 and GDPR).
Transactional Emails: Resend / SMTP providers utilizing encrypted protocols.

Whenever data is processed outside the European Economic Area (EEA), transfers are governed by Standard Contractual Clauses (SCCs) approved by the European Commission or equivalent adequacy decisions.

As a data subject, you hold the following statutory rights under the GDPR:

Right of Access (Art. 15 GDPR): Obtain confirmation as to whether your personal data is being processed and receive a copy of such data.
Right to Rectification (Art. 16 GDPR): Request correction of inaccurate or incomplete personal data.
Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR): Request deletion of your personal data when it is no longer necessary, subject to statutory retention obligations (e.g. security logs and fiscal records).
Right to Restriction of Processing (Art. 18 GDPR): Request limitation of processing under specific legal conditions.
Right to Data Portability (Art. 20 GDPR): Receive your structured, commonly used, and machine-readable data.
Right to Object (Art. 21 GDPR): Object at any time to data processing based on legitimate interests.

To exercise any of these rights, contact our Data Protection desk at [email protected]. We will respond within thirty (30) days as prescribed by law.

8. Modifications to this Policy

RiskShelter reserves the right to revise this Privacy Policy periodically to reflect legal amendments, regulatory updates, or technical evolutions. Significant modifications will be communicated via email or through prominent notifications on the Platform.