Privacy Policy

1. Who we are

Custodis is operated by Calyra, which is the controller of the personal data described here. You can reach us about anything in this policy at privacy@custodis.app.

2. What we collect

We collect what we need to run the service. Account data: your email address, your name, a hashed password, and — if you set them up — a passkey's public key and a two-factor authentication secret. Session and security data: the IP address and browser user agent of each signed-in session, and a log of actions taken in your organization with the IP address and user agent they came from. Organization data: the organization's name, its industry sector from a fixed list, and the email addresses of people you invite. Scan data: the domains you register or add as suppliers; the hostnames under them that certificate transparency logs show, or that answer a DNS lookup of one of 30 common names such as www, mail or admin (the full list is in our Responsible Scanning Policy); what our checks observe — DNS records, certificate details, HTTP response headers, the first 4 KB of a home page and, only where active checks are enabled, the first bytes a network service sends; and, for each of your own domains with passive discovery on, whether verified yet or not, the registered domains whose names resemble it, with their public DNS records. If you pay by invoice, we keep the billing details you send us. We do not collect location data, and the product uses no analytics, advertising or tracking tools.

3. How we use it, and why we may

We use your data to provide the service you signed up for — running scans, computing scores, sending the alerts and reports you configure, and answering support requests you make (lawful basis: performance of our contract with you). We use session and security data to keep accounts and the platform secure, and scan data about the domains customers register, including their suppliers' domains, to provide the monitoring they have asked for (lawful basis: our legitimate interests in operating a secure monitoring service). We keep invoicing records because tax law requires it (lawful basis: legal obligation). To show industry benchmarks, we combine the overall and category ratings of paying organizations into banded ranges; a benchmark is shown only when at least five other organizations contribute to it, and no individual organization's rating is ever shown to another.

4. What we do not do

We do not sell your data. We do not share it with data brokers, advertising networks, or any third party not listed in section 6. We do not train machine-learning models on your data. We do not share your scan evidence with anyone else — including researchers, regulators or other Custodis customers — without a lawful order or your written instruction. We do not use your data for any purpose outside those described above.

5. Where it lives

All of the service runs in the European Union: database with PlanetScale in the Netherlands, website and application hosting with Vercel in Frankfurt, Germany, scan engine hosting with Railway in Amsterdam, the Netherlands and transactional email with Resend in Ireland. Data is encrypted in transit with TLS, and our database provider encrypts it at rest and keeps automated backups. Every read and write the application makes is scoped to the organization it is acting for, so one organization's data is never returned to another.

6. Sub-processors and services we query

These providers process personal data on our behalf, each under its standard data processing terms: PlanetScale (database), Vercel (website and application hosting), Railway (scan engine hosting) and Resend (transactional email). While scanning, the scan engine also queries services that receive only domain names or IP addresses, never account data: Cloudflare (DNS resolution), crt.sh and Cert Spotter (certificate transparency search), and Team Cymru (IP-to-network lookups). We will update this list before adding a new sub-processor.

7. Your rights

You have the right to access the data we hold about you, to correct anything that is inaccurate, to receive a copy of it — your findings can be exported as CSV from the dashboard at any time — and to have your account or your organization and its data deleted. You may also object to processing based on our legitimate interests. People in the EU and UK have the rights afforded by the GDPR, including the right to lodge a complaint with a supervisory authority; California residents have the rights afforded by the CCPA. To exercise any right, write to privacy@custodis.app and we will respond within thirty days.

8. Cookies

The product sets only the cookies needed to keep you signed in and to complete multi-factor sign-in. They are never used for tracking or advertising. The marketing site sets no cookies at all and loads no analytics or tracking scripts.

9. Retention

Account, organization and scan data are kept for as long as the organization exists. When a trial or a paid period ends without renewal, the organization becomes read-only and its data is kept, so it can be renewed without loss. We delete an organization and its data when you ask us to; deleted data leaves our database provider's backups as they roll over. Invoicing records are kept for as long as tax law requires.

10. Children

Custodis is a B2B product directed at security and risk teams. It is not directed at anyone under the age of eighteen, and we do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, contact privacy@custodis.app and we will delete it.