Privacy policy

Who are we?

CyberVigil (cybervigil.ai) is a free website and email security checkup for small businesses. It's operated by Routeless. When this page says "we" or "us", it means CyberVigil and Routeless.

What's the short version?

• You don't need an account to run a check.
• We store the address you check and the public results, so your report link keeps working.
• We don't store your raw IP address. We store a one-way, salted hash of it to enforce rate limits.
• We only collect your email or name when you choose to fill in a form.
• We don't sell your data, and we don't use advertising trackers.

What do we collect when you run a check?

When you run a full check, we store the following information.

• The address you entered is saved as the domain and a cleaned-up web address, like https://yourbusiness.com/. Any page path you typed is dropped.
• We save the scan results. These are public information about the domain, such as DNS records, certificate details, the security headers and cookie names its homepage sends, and the detected website platform, email provider, and DNS host. We also store the score and the report summary.
• We also store a hashed version of your IP address. We combine your IP address with a secret value and run it through a one-way hash, then use the result to limit how many checks one visitor can run. We don't store your raw IP address in our database.
• Timestamps show when the check started and finished. If you re-check, we also link the new report to the previous one so we can show what changed. If a check fails, we keep a short technical error message.

The single-check tools, like the DMARC checker and SSL checker, show results without saving them. For those, we only store a hashed-IP record for rate limiting.

Who can see my report?

Each report has its own long, random link. Anyone with the link can view the report, so treat it like a shared document link. Reports aren't listed on our site, and we tell search engines not to index them.

If someone else checks the same domain within 10 minutes of you, they'll see the same report. Reports contain only public information about the domain, nothing about who ran the check.

What do we collect through forms?

We only collect contact details when you choose to give them to us.

• If you ask us to email you a report, we store your email address, the report it relates to, and whether you ticked the box to receive updates. We use it to send your report link, and we only send other updates if you opted in.
• Joining the waitlist means we store your email address, the plan you're interested in, whether you prefer monthly or annual billing, and your domain if you add it. We use it to tell you when that plan opens.
• When you request help, we store your name, email address, your message if you add one, and the report and finding it relates to. We use it to reply to you.
• If you email hello@cybervigil.ai, we keep the conversation so we can help you.

Waitlist sign-ups and help requests are also sent to our team inbox so a person can follow up.

How do we use information?

We use the information above to:

• Run checks and show you your report.
• Send the emails you asked for.
• Prevent abuse, using rate limits and an optional human check.
• Reply to your questions and help requests.
• Fix mistakes in our checks and improve the service.

We don't sell, rent, or trade your personal information. We don't share it with advertisers.

Which service providers do we use?

We use a small number of providers to run CyberVigil. Each one only receives what it needs to do its job.

We download the Phishing.Database blocklist in full, so we don't send your domain to it.

Do we use cookies or tracking?

We don't set our own cookies, and we don't use advertising or cross-site tracking scripts. Our fonts are served from our own domain.

When the Turnstile human check appears, Cloudflare may use the cookies or similar storage it needs to work. That's covered by Cloudflare's own privacy policy.

How long do we keep information?

We keep scan reports so that your report links keep working. Reports don't expire automatically today.

We keep form submissions for as long as we need them for the reason you gave them to us. For example, we keep waitlist sign-ups until the plan opens and we've let you know. Rate-limit records contain only hashed IP addresses and are used only for rate limiting.

You can ask us to delete a report or your email address at any time. Email hello@cybervigil.ai with the report link or the email address you used.

What are my choices and rights?

You can ask us to:

• Tell you what personal information we hold about you.
• Correct it if it's wrong.
• Delete it.
• Stop sending you updates.

Depending on where you live, you may have additional rights under local law. We'll honor reasonable requests wherever you are. To protect you, we may ask you to confirm a request from the email address involved.

How do we protect information?

All traffic to CyberVigil is encrypted with HTTPS. Our database isn't publicly accessible, and only our own servers can read from it. Our site also sends the browser security settings we recommend in our reports.

No system is perfect. If we learn of a breach that affects your personal information, we'll notify you as required by law.

Is CyberVigil meant for children?

No. CyberVigil is built for businesses and isn't directed to children under 13. We don't knowingly collect personal information from children. If you believe a child has given us information, email us and we'll delete it.

Will this policy change?

We may update this policy as CyberVigil grows, for example when our paid plans open. When we do, we'll change the updated date at the top of this page. If a change significantly affects information you've already given us, we'll tell you on the site or by email.

How do I contact you?

Email hello@cybervigil.ai with any privacy question or request. See what we check for how our checks work, and our terms of use for the rules of the service.