Security at GhostVault.

1. Encryption and password storage

Every request between your browser and GhostVault is served over HTTPS using TLS 1.2 or higher, with HSTS enforced (max-age=63072000). Two-factor secrets are encrypted with a key kept outside the database. Passwords are hashed with bcrypt (cost factor 10), so we cannot read them even if compelled.

2. What we actually store about you

We collect the minimum needed to send legally-binding CCPA deletion demands on your behalf:

• Account: Email address, bcrypt-hashed password
• Scan data: First name, last name, optional city/state, optional email for breach lookup
• Billing: Handled entirely by Stripe. We never see or store your card number, CVC, or billing address
• Usage: Sign-in times and the sign-in method, and other security changes on your account. New entries do not record your IP address or device. Our own counts are anonymous daily totals of steps such as "scan started" and "signed up", and of page views by path and referrer domain, with no cookies and nothing that identifies you.

We do not collect your SSN, date of birth, driver's license, financial account numbers, or health data. We never ask for a phone number unless you explicitly add one for removal.

3. Access controls

Internal access to production data follows the principle of least privilege. Engineering access to the production database is gated behind multi-factor authentication and is logged. We do not export bulk user data to analytics warehouses, BI tools, or marketing platforms.

4. Retention and deletion

Scan results are retained only as long as they're needed to track removal status and respond to data-broker follow-ups (typically 12 months). If you delete your account, your scan data and monitored addresses are erased from active systems right away. Cancelling a subscription alone does not delete your data.

5. Sub-processors and vendors

We use a small number of vendors to operate the service:

• Stripe: Payment processing (PCI-DSS Level 1)
• Cloudflare: Website hosting (Cloudflare Pages) and Cloudflare Web Analytics
• Railway: Database hosting (SOC 2 Type II)
• Resend: Transactional email (GDPR-compliant)
• Meta: Meta Pixel (Facebook), to measure advertising effectiveness

Cloudflare Web Analytics counts page views and page load times without cookies. It does not store your IP address or build a profile of you.

Meta Pixel loads on public pages, including the homepage and this page. The pixel script does not load when a visit starts on the signed-in dashboard (/dashboard). Our code sends a page view when the pixel loads. When a free scan returns a match, it sends a conversion event whose only details are the labels "Free Privacy Scan" and "scan". A sign-up sends the plan identifier and the listed price in US dollars. No personal scan data or removal information is shared with Meta. These events do not include your name, email, city, state, scan results, or removal records. You can opt out via your browser's ad preferences or by using an ad blocker.

We do not sell your personal information. We do not share scan results, removal data, or breach information with advertisers.

6. Incident response

In the event of a security incident that affects your personal information, we will notify you by email without unreasonable delay, as state breach-notification laws require. Our response covers containment, review of what was affected, customer notification, and regulator disclosure where the law requires it.

7. Compliance posture

• CCPA / CPRA: California residents can authorize us to make CCPA requests. Other customers receive deletion requests with wording based on their state. We track delivery, replies and follow-ups; an internal review date does not establish a legal violation.
• SOC 2 Type I: In scoping. Target audit window: TBD. We'll update this page with the auditor and timeline as soon as it's signed.
• GDPR (EU/UK): We do not currently target EU/UK users. If you are outside the US, our scan is available but removal coverage is US-only for now.
• HIPAA: Not applicable. We do not collect or process protected health information.

8. Responsible disclosure

If you've found a security issue in GhostVault, please email security@ghostvault.live with details. We review every report, do not pursue legal action against good-faith researchers, and credit reporters who want to be credited.

9. Contact

Questions about this page, or about how we handle your data? Email privacy@ghostvault.live.