Privacy Policy

Who we are

Secuur is a post-quantum readiness service operated by Secuur LLC ("we", "us"). For any question about this policy, write to [email protected].

What we collect

• Scan inputs and results. The domain you submit, the TLS facts our prober observed, and the grade we computed. A scan is an ordinary TLS handshake against a host you nominate.
• Contact details you give us. Name, work email, company, phone and role, when you submit a form, book a call or start a conversation with the on-site assistant.
• Assistant conversations. Messages you send to the on-site assistant, so it can hold context across turns.
• Account and billing records. If you subscribe, your account email and subscription status. Card details go directly to Stripe and are never stored by us.
• Session and request data. A first-party secuur_sid cookie, plus standard server and CDN logs containing IP address, user agent and requested URL.

What we do not do

• We do not sell personal information, and we do not share it with advertisers.
• We do not run third-party advertising or cross-site tracking pixels on secuur.me.
• We do not attempt authentication, exploitation or payload delivery against any domain you submit for scanning.

Cookies

For the service, we set a first-party cookie, secuur_sid, which is HttpOnly, Secure and SameSite=Lax. It identifies your session so a conversation or a booking can be continued. It is not used for advertising or cross-site tracking.

Optional website analytics

With your explicit permission, Google Analytics measures visits to our public homepage. It receives a fixed homepage address and title, a referrer limited to the referring website origin, and standard browser/device and request information. Query strings, URL fragments, scan inputs, form values and assistant conversations are not sent by this integration. Scanning, CRM, application, account and payment pages are excluded. Advertising features and Google signals are disabled.

Analytics is off until you choose Accept analytics. If accepted, Google Analytics may set first-party _ga cookies; your preference is stored in browser local storage. Use Analytics preferences on our homepage to change your choice. Declining removes the Analytics cookies this integration can access and stops measurement. Analytics is also disabled for the rest of a page visit when you focus a data-entry field. Google is an additional processor for this optional measurement.

October 20 update: added optional consent-based homepage Analytics and its controls. The existing service session cookie remains separate.

Legal bases

Where the UK GDPR or EU GDPR applies, we rely on legitimate interests for operating and securing the service and responding to enquiries, contract for providing a subscription you have bought, and consent where you volunteer information through a form. You may withdraw consent at any time.

Scanning a domain you do not control

The readiness scan performs an unauthenticated TLS handshake — the same request any browser makes. You are nonetheless responsible for ensuring you have a legitimate reason to assess a domain you submit. We log the submitted domain and the requesting session.

Retention

• Scan results and assistant conversations: retained while your account or session record is active, and deleted on request.
• Contact records from forms and bookings: retained for up to 24 months from last contact.
• Server and CDN request logs: retained for up to 90 days.
• Billing records: retained as long as tax and accounting law requires.

Subprocessors

We use a small number of third parties to run the service. The current list, with what each one receives, is published on our Security page.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to processing, or to lodge a complaint with a supervisory authority. Write to [email protected] and we will respond within 30 days. We do not charge for a first request.

International transfers

Our infrastructure and most of our subprocessors are located in the United States. If you contact us from outside the United States, your information will be processed there.

Children

Secuur is a business service and is not directed at anyone under 16. We do not knowingly collect information from children.

Changes

We will update the effective date at the top of this page when this policy changes, and describe material changes on this page rather than only in a changelog.

Contact

Secuur LLC — [email protected]. For security matters, see Security.