Privacy Policy

Who we are

PostureCheck is a free domain security scanner operated from Ireland. For the purposes of the General Data Protection Regulation (EU) 2016/679, the operator of posturecheck.io is the data controller. Contact details are in the final section.

What we collect

Scan requests. When you scan a domain, that domain name is sent to our server so the checks can run. The domain is used to perform the scan and is not stored afterwards. We keep no scan history, no results database, and nothing linking a scan to a visitor.

IP address, briefly. Your IP address is held in memory for a short period so we can apply rate limits and prevent the service being abused as a scanning proxy. It is not written to a database and is discarded within minutes. The lawful basis is legitimate interest under Article 6(1)(f) — specifically, keeping a free service available and preventing misuse.

Analytics. We use a privacy-focused analytics service to count page views and see which pages are used. It is cookieless and does not use persistent identifiers or cross-site tracking. We cannot identify individual visitors from it. The lawful basis is legitimate interest in understanding whether the tool is useful.

Server logs. Our hosting provider records standard request logs, which can include IP addresses, timestamps and requested URLs. These are generated and retained by the provider as part of operating the platform, and are used only for security and troubleshooting.

What we do not collect

• No accounts, names, email addresses or passwords — there is nothing to sign up for
• No tracking or advertising cookies
• No scan history, and no record of which domains were scanned by whom
• No sale or sharing of data with advertisers or data brokers

Unlike some comparable tools, results are never published. A scan you run is not added to any public index.

Processors

We use a third-party cloud hosting provider for the website, its serverless functions and its analytics. They process request data on our behalf as a data processor under a data processing agreement, and rely on Standard Contractual Clauses where data is transferred outside the EEA. We can tell you who they are on request.

We use no other third-party services on this site — no advertising networks, no social media embeds, no external fonts or scripts beyond those needed to serve the page.

Retention

Scan inputs and results are not retained. Rate-limiting data is held in memory and discarded within minutes. Analytics data is aggregated and retained by our hosting provider according to their policy, as are standard request logs.

Your rights

Under the GDPR you have rights of access, rectification, erasure, restriction, objection and portability in relation to personal data we hold about you. In practice, because we hold no accounts and retain no scan history, there is usually nothing to retrieve or delete — but if you believe we hold data about you, contact us and we will respond within one month.

You also have the right to lodge a complaint with a supervisory authority. In Ireland this is the Data Protection Commission, dataprotection.ie.

Scanning other people's domains

The tool checks publicly published DNS records, TLS certificates and HTTP response headers. This is the same information any web browser or mail server receives, and it is not personal data. You are responsible for how you use the tool. If you operate a domain and would prefer we did not scan it, contact us and we will add it to an exclusion list.

No warranty

PostureCheck reports externally observable configuration at the moment a scan runs. It cannot assess internal systems, application security, access controls or anything not visible from the public internet. A good score does not mean a domain is secure, and results may be incomplete or incorrect. The service is provided as-is, without warranty, and you should not rely on it as your only assessment. Nothing here constitutes professional security, legal or compliance advice.

Changes

If this policy changes materially we will update the date at the top of this page.

Contact

For any privacy question, data request or scanning exclusion, email privacy@posturecheck.io.