Privacy policy
Translation provided for convenience. The French version is the only legally binding version.
Updated on 31 October 2026.
Who is responsible
NB Cyber Security, represented by Najib Bredaa, is the controller for the processing described here. For any question or to exercise your rights: contact@securit-e.com.
What we process, why, and for how long
| Processing | Data | Why (legal basis) | Duration |
|---|---|---|---|
| Site audience measurement (our engine) | Page viewed, referring site, campaign (utm_source), device type, reading mode chosen, buttons clicked, non-reversible daily fingerprint. Your IP address is not recorded. | Understanding how the site is used (legitimate interest). No cookies. “Do Not Track” and “Global Privacy Control” switch this measurement off. | 13 months |
| Umami audience measurement (open-source software installed on our own server, in France; public pages only) | Page address (without parameters or fragment), title, referring site, browser, operating system, device type, screen size, language, country derived from the IP address at the time of the visit. The IP address is not recorded; a non-reversible fingerprint, renewed every month, links the pages of a single visit. | Measuring visits to the public pages (legitimate interest). No cookies, no third-party service. “Do Not Track” and “Global Privacy Control” switch this measurement off. Never present in the evaluation workspace, the administration area, the platform, the reports or the engine’s responses. | No automatic deletion is scheduled at present |
| Anti-bot check (public pages only) | IP address (in memory only, never written to disk), browser identifier, result of a short calculation performed by your browser on the first visit, security cookie “__mur”. A security script also reports browsers controlled by a program, JavaScript errors and loading times (page address only). Your address is checked on our server against a public list of malicious addresses (CrowdSec, downloaded; nothing is sent to them). | Protecting the site against bots, scraping and automated attacks (legitimate interest; cookie strictly necessary for security, exempt from consent). | Cookie: 7 days; blocks held in memory: 1 to 24 h; errors and loading times: 30 to 40 days, as counters |
| Technical log of the gateway (public pages) | Date, page requested, browser, response code and a short fingerprint of the IP address (truncated, unsalted SHA-256: this is pseudonymisation, not anonymisation). The addresses of the workspace, the engine, the administration area, the platform and the reports are not logged. | Server operation and security, traffic statistics (legitimate interest). | Log: 72 h; hourly fingerprints used to count unique visitors: 40 days |
| Exposure scan | The domain name you enter, the score obtained, the date. | Providing the scan you request and measuring its use (legitimate interest). | 13 months |
| Proposal request | Name, company, email, phone, need, message. | Replying to you and following up on your request (pre-contractual measures, at your request, with your explicit consent). | 3 years from receipt, then automatic deletion |
| Trial access | The code used, the activation date, the receipt issued and, if the code was given to you by Najib Bredaa, your company name. | Opening the access requested (performance of the request). | Duration of the business relationship |
| Trial space | The domain names you have analyzed, the score and summary obtained (last 10 analyses). The link to your space is only stored as a non-reversible fingerprint. | Providing the analysis requested and showing it to you again (performance of the request). | Duration of the trial, then duration of the business relationship |
| NIS 2 pre-assessment | Domain name analyzed, company name, NIS 2 status and declared answers, results of the passive analysis; your name, email and phone are added to the proposal requests. The sealed file (without your contact details) is kept with its fingerprint and timestamp; only its verification link, which you choose to pass on, allows it to be viewed. | Producing the file requested, guaranteeing its integrity and date, and contacting you again (performance of your request, with your explicit consent). | 3 years from issue; contact details: 3 years, then deletion |
| Partner program | Name, company, profession, email, phone, message. | Replying to your partnership request (pre-contractual measures, with your explicit consent). | 3 years from receipt, then automatic deletion |
| Full platform (under securit-e.com/app) | Accounts (username, email address, role), login sessions, contact requests, and the security results for the domains you monitor there. | Providing the platform you are trying or have subscribed to (performance of the request or contract). | Duration of the trial or contract; no automatic deletion of sessions and requests is scheduled at present |
| “Sentinelle” AI assistant | Your questions, for the time needed to produce the answer. Only anonymous counters are kept (language, whether an answer was given, where the answer came from). Card numbers, IBANs, passwords and codes detected in a question are removed before the AI even reads them. | Answering your question (legitimate interest). Processed first on our servers in France, by an open model. If this AI is overloaded or unavailable, the question, already stripped of sensitive data, is sent to NVIDIA’s AI service (United States) to produce the answer, without your IP address or any identifier, up to a limit of 300 questions per day for the whole site; NVIDIA processes it under its own terms. | Questions not stored; counters: 13 months |
| Password check | Your password never leaves your device. Only the first 5 characters of its SHA-1 fingerprint are sent. | Telling you whether this password appears in a known breach (at your request). | Not stored |
| Site security | Encrypted fingerprint of the address (non-reversible without a key), kept in memory to limit abuse; log of logins to the administration area. Before a scan or a form submission, your browser performs a short calculation (proof of work) that uses no personal data. | Protecting the service (legitimate interest). | 24 h in memory; 13 months for the administration log |
Who receives this data
Only NB Cyber Security. The site is hosted in France by IKOULA, in its Eppes data centre. We do not sell, rent or share any data. The only transmissions to outside parties are described below; they leave from our server and never contain your IP address.
To produce a scan, the domain name you enter (and only that, never any data about you) is sent to the public registries queried: crt.sh (Sectigo), CertSpotter (SSLMate, United States), subdomain.center (country not stated by the service), Internet Archive (United States) and Google’s public DNS resolver (United States). Since 13 October 2026, the IP addresses of the servers found are no longer submitted to any third-party exposure database. No connection is ever made to your own machines.
The full report of an evaluation workspace also queries the RDAP domain name registries (IANA and the domain’s registry), RIPEstat (RIPE NCC, Netherlands) for the operator and country of the servers’ IP addresses found, and the public NVD (NIST, United States) and EPSS (FIRST, United States) databases for known vulnerabilities; it visits a single home page per site found, plus its security.txt file, as a browser would (see the terms of use, article 1). The fraud simulator queries public DNS and the RDAP registries for domain names similar to yours.
To check a password, our server sends only 5 characters of the fingerprint to the public Pwned Passwords service (Have I Been Pwned), without your IP address; this service cannot recover your password. To display the latest recorded breaches, our server reads the public page of bonjourlafuite.eu.org; nothing about you is sent to it.
To seal a NIS 2 file, only its SHA-256 fingerprint (and no readable data) is sent to a third-party timestamping authority: FreeTSA (Germany), or DigiCert (United States) as a fallback. To flag actively exploited flaws, the public catalog of CISA (United States) is downloaded; no data is sent to it.
Our backups are encrypted on our server before being copied to a private repository at GitHub (Microsoft, United States); the decryption key never leaves our server.
Transfers outside the European Union: the domain name you have scanned (Google, SSLMate, Internet Archive, NIST, FIRST and, depending on the case, Sectigo and subdomain.center), 5 characters of a password’s hash (Have I Been Pwned), the hash of a sealed file as a fallback (DigiCert), a question to the assistant stripped of sensitive data when our AI is overloaded (NVIDIA) and our encrypted backups (GitHub). None of these transmissions contains your IP address.
Cookies and local storage
The public site sets no measurement or advertising cookies. A single technical cookie is set: “__mur”, strictly necessary for the anti-bot check (signed random identifier, valid for 7 days, unreadable by the page’s scripts). Your reading choice (“plain language” or “technical”) is stored in your browser and nowhere else; it is not used for any tracking. If you open an evaluation workspace, its personal link is stored in this browser so you can find it again; the “Forget this device” button erases it. The administration area, reserved for NB Cyber Security, uses a session cookie that is essential for logging in. Opening the full platform from a workspace sets two technical session cookies (wiinup_session, wiinup_csrf), essential for that login.
Your rights
You may request access to your data, its rectification, its erasure or the restriction of processing, object to processing and request portability: write to contact@securit-e.com. We reply within one month. If you believe your rights are not being respected, you may lodge a complaint with the CNIL (cnil.fr).
Security
Encrypted connection (TLS 1.2 and 1.3 only), strict content security policy, services isolated in read-only containers, daily encrypted backups, administration area protected by password and second factor.