1. Overview
VoidFort ("we", "us", "our") provides a managed Web Application Firewall (WAF) service and an ephemeral security audit. This policy explains what data we collect, why we collect it, who else processes it, and how long we keep it.
2. Data we collect
Website visitors
The website is hosted on GitLab Pages. The host processes your IP address and request data in its server logs.
Instant scan
When you use the instant scan on the audit page, we receive the domain you enter. We also see your IP address, which we use to limit the number of scans. Requests to our API (api.voidfort.com) pass through Cloudflare.
Audit requests
When you order a security audit, we collect:
- Your email address: to verify domain ownership and deliver the PDF report.
- The target domain name: to run the scan.
- The scan result and the PDF report.
For a paid audit, payment is handled by Stripe. We receive the payment status. We do not store card numbers.
After a free audit report is delivered, your email address, the audited domain and the scan verdict can be added to a mailing list at Brevo. We use the list to send follow-up messages about VoidFort. A contact on the mailing list is kept until you unsubscribe or ask us to delete it (section 8).
The temporary VPS that runs the scan is deleted after the report is delivered. The scan result and the report stay in our systems for the period in section 4.
Waitlist form
The waitlist form collects your email, your website address, the site category and your message. The form is processed by web3forms, which forwards it to us by email.
Shield customers
Customers of the Shield service additionally provide or generate:
- An account email address. Customers sign in with a one-time code sent by email. Staff accounts use a password, stored as a hash.
- Billing details, processed by Stripe. We do not store card numbers.
- Domains and origin server addresses, plus the settings you choose (rules, allow and deny lists).
Traffic of protected sites
A Shield node processes the requests that your visitors send to your site: IP address, country, requested address and request headers. The node uses this to apply your rules and to detect attacks. The node's access log is read by CrowdSec, the intrusion detection software on the node.
The node sends aggregated counters to our control plane: request counts, blocked requests, and breakdowns by country, ASN (the visitor's network) and attack category, plus the most requested paths (up to 20, without query strings). These counters do not contain individual visitor IP addresses. The exception is IP addresses that you or our staff ban by hand.
3. How we use data
- Deliver audit reports and verify domain ownership.
- Provision and manage your Shield node.
- Detect and block malicious traffic. Bans apply to every domain on the same node.
- Send transactional emails (verification, report delivery, billing receipts, critical alerts).
- Send follow-up messages about VoidFort after a free audit (see section 2).
- Measure how the website is used, only if you accept analytics cookies (see section 5).
We do not sell your personal data.
4. Data retention
- Audit email, domain and result: kept for 90 days, then deleted.
- Account data: kept while the account exists. We delete it on request to [email protected], within 30 days.
- Mailing list contact (Brevo), if you are subscribed: kept until you unsubscribe.
- Payment records (amount, currency, status, Stripe identifier; no email address or domain): kept longer, as the law requires.
- Traffic statistics: per-minute values for 48 hours, per-hour values for 30 days, per-day values for 400 days.
- Banned IP addresses: kept until the ban expires or is lifted. Every ban has an expiry date.
5. Cookies and analytics
We use Google Analytics (Google) to count visits and to see which pages and features are
used. Google Analytics sets cookies (named _ga and _ga_…) and
sends data to Google, including to servers in the United States.
Google Analytics loads only after you click "Accept" in the banner. If you click "Decline", or do not answer, the site does not contact Google Analytics and sets no analytics cookie. You can change your choice at any time with the "Cookie settings" link in the footer.
With your consent, we record page views and these events: running the simulator, the result of an instant scan (verdict and score, not the domain), starting an audit order (tier and price), and sending the waitlist form (site category).
Your choice is stored in your browser (localStorage, key vf-consent). The website sets
no other cookies. When you sign in to the customer dashboard, it sets one strictly
necessary cookie, voidfort_refresh (HttpOnly, valid for up to 30 days), to keep you signed in.
When you pay, Stripe sets its own cookies on stripe.com.
6. Simulator on the home page
The simulator on the home page contacts two third-party services in your browser:
- api.ipify.org receives your IP address when the page loads, and returns it so the simulator can show it as the "attacker" address.
- Google Public DNS (dns.google) receives the domain you type into the simulator, to look up its IP address.
These requests happen without a consent step. The simulator does not send them to us.
7. Third-party processors
- Cloud VPS provider (name available on request at [email protected]): hosts Shield nodes and the temporary audit scanners.
- Stripe: payment processing. Subject to its own privacy policy.
- Brevo: contact list and follow-up emails after a free audit.
- SMTP email relay: delivery of transactional emails (verification, reports, receipts).
- Cloudflare: proxy in front of our API.
- GitLab: hosts this website.
- Google: Analytics (only after consent) and Public DNS (simulator).
- ipify: returns your IP address to the simulator.
- web3forms: processes the waitlist form.
- CrowdSec: the CrowdSec software on each node downloads a community blocklist and, by default, reports to CrowdSec the IP addresses that attacked your site.
- Let's Encrypt: issues TLS certificates for protected domains. Domain names in certificates are public.
Each of these parties has its own privacy policy.
8. Your rights
You may request access to, correction of, or deletion of your personal data at any time by emailing [email protected]. Requests are processed within 30 days.
If you are in the EU/EEA, you have rights under GDPR, including the right to lodge a complaint with your local supervisory authority.
9. Security
Connections to our website, API and dashboards use TLS (version 1.2 or newer). Traffic between our control plane and Shield nodes is authenticated. No system is perfectly secure, and we cannot guarantee absolute security.
10. Changes to this policy
We may update this policy as the service evolves. Material changes will be communicated by email to active customers at least 14 days before taking effect.
11. Contact
Questions? Email [email protected].