Privacy policy
This policy explains which personal data Noctis processes, why, and what your rights are. We collect as little as possible, never sell data and never use it for advertising.
1. Who is responsible
Hostiva (operator of Noctis), Graan voor Visch 14802, 2132 VB Hoofddorp, the Netherlands. KVK 42061379 · info@noctisec.com
Hostiva is the controller for the personal data described below.
2. What we process and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email address, company name, password (stored only as a one-way hash), timezone, plan | Your account, logging in, sending reports and alerts | Contract (art. 6(1)(b)) |
| Websites you add, verification tokens, scan results | Providing the scanning service | Contract (art. 6(1)(b)) |
| IP address and time of logins, failed logins, password changes and similar events | Protecting your account, detecting abuse, showing you your security activity | Legitimate interest in security (art. 6(1)(f)) |
| IP address and time when you enable active scans | Proof that you authorized intrusive testing | Legitimate interest and legal claims (art. 6(1)(f)) |
| Billing details (name, billing address, VAT number, payment status; handled by Stripe) | Invoicing and bookkeeping | Legal obligation (art. 6(1)(c)) |
Scan results describe your websites, not people. If a website you scan exposes personal data (for example in a leaked file), we only record where the problem is, not the contents.
3. How we protect your data
- All traffic uses HTTPS (TLS) with HSTS.
- Your email address, company name, websites, scan results and security logs are encrypted in our database (field-level encryption). The keys are stored separately from the database.
- Passwords are stored as salted scrypt hashes; we can never see your password.
- Logins are protected against brute force (rate limits and temporary account locks), and every form is protected against cross-site request forgery.
- Servers are hosted in the EU, kept up to date automatically and accessible only to us with cryptographic keys.
4. Who we share data with
Only with service providers that we need to run Noctis, under a data processing agreement:
- Hetzner Online GmbH (Germany): servers and backups, in EU data centers.
- Our email provider (EU): delivering reports, alerts and account emails.
- Stripe Payments Europe Ltd. (Ireland): processing payments and invoices. Card and bank details go straight to Stripe; we never see or store them.
Our website loads no fonts, scripts or other files from third parties: everything is served from our own server.
We don't share data with anyone else unless the law requires us to.
5. Cookies
We use one cookie, noctis_session, which keeps you logged in and protects forms. It is strictly necessary, expires after 7 days
and contains no tracking. We use no analytics, advertising or tracking cookies, so we don't ask for cookie consent.
6. How long we keep data
- Account data, websites, scan results and security logs: as long as your account exists.
- When you delete your account, everything is deleted from our database immediately. Server backups roll over within 7 days, after which the data is gone from backups too.
- Invoices: 7 years, as Dutch tax law requires.
7. Your rights
You have the right to access, correct, delete and receive a copy of your data, and to object to or restrict its processing.
- Copy of your data: download it any time from your account page ("Download my data").
- Deletion: delete your account yourself from your account page.
- Anything else: email info@noctisec.com. We respond within one month.
You can also file a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens.
8. Data breaches
If a breach affects your personal data, we report it to the Autoriteit Persoonsgegevens within 72 hours where required, and inform you without undue delay.
9. Changes
We may update this policy. We announce material changes by email. The version on this page applies.