Where your data lives, what we keep, and what never leaves your own machine.
When you upload a firewall configuration, it is parsed in memory and discarded when your report is returned. It is never written to disk, never added to a backup, and never used to train anything.
The report itself contains no configuration text. Findings describe matched policy — a rule's position and its effective match, such as "policy 3 permits any to any on any service". That is what makes the report safe to send to an auditor, and it is why the review works for customers whose configurations may not leave their own control.
For organisations that cannot upload configurations at all, the same engine runs as a command line tool on your own machine. Nothing is transmitted.
| Data | Retention |
|---|---|
| Account email and name | Until you ask us to delete it |
| Uploaded configuration | Not retained — discarded with the response |
| Report contents | Not retained |
| Review record (vendor, counts, date) | Audit trail only, no findings |
| Demo requests | Until the enquiry is closed |
Findings come from deterministic checks with unit tests behind them, not from a language model. A model may help explain a finding; it never decides whether one exists. That is what makes results reproducible and defensible when a regulator asks how a conclusion was reached.
Security and privacy questions go to connect@securexcel.com. We answer security questionnaires and can sign a DPA.
The Digital Personal Data Protection Act 2023 gives you rights over the personal data we hold. These are the mechanisms, not a description of them.
| What we collect | Your name, email address and company when you create an account or send an enquiry, and a phone number if you give one. Nothing else. |
|---|---|
| What we never store | Firewall configurations, cloud credentials and report contents. Configurations are parsed in memory and discarded; cloud credentials are used for one request and dropped. Only a finding count and a score are kept. |
| How long we keep it | Enquiries for 24 months. Sessions until they expire. Account details until you delete the account. Erasure runs on a daily timer, not on request. |
| Right to access — s.11 | Download everything we hold about you as JSON, immediately, while signed in. |
| Right to erasure — s.12(3) | Delete your account from your dashboard. Review counts remain as anonymous statistics with nothing linking them to you. |
| Right to correction — s.12 | Email connect@securexcel.com and we will correct it within one working day. |
| Grievances — s.13 | Email connect@securexcel.com marked "DPDP grievance". We acknowledge within one working day. If you are not satisfied you may complain to the Data Protection Board of India. |
| In transit | Traffic between you and the service is encrypted with TLS 1.2 or 1.3. TLS 1.0 and 1.1 are refused, HSTS is set, and plain HTTP redirects. This covers the connection between you and us; it is not a claim about traffic inside our cloud provider's own network. |
|---|---|
| At rest | Stored data is encrypted with AES-256 using Oracle Cloud Infrastructure block volume encryption, with Oracle-managed keys. The database file is additionally readable only by the account that runs the application, and secrets sit in a file readable only by root and that account. |
| Passwords | PBKDF2-HMAC-SHA256, 600,000 iterations, per-user salt. We cannot read your password. |
| Access | The origin refuses any request that did not arrive through the load balancer and web application firewall. |
| Data residency | Processing and storage are in an Indian cloud region. Nothing is replicated outside India. |