Privacy Policy

Last updated October 2026

1. Data controller

The data controller is Perspective Analytics SAS, 2 rue du Général de Gaulle, 44290 Guémené-Penfao, France. For privacy inquiries, contact .

Data Protection Officer. Perspective Analytics SAS has not appointed a Data Protection Officer, as none of the criteria of Article 37 GDPR are met. All data protection inquiries, including requests under Articles 15 to 22 GDPR, are handled by the privacy contact above.

2. Data we collect

Account data

At signup we collect an email address, verify it with a one-time code and collect an organization name. A password is optional; if configured, it is hashed with Argon2id. Profile information includes a name where supplied and a role. If MFA is enabled, its secret is encrypted with AES-256-GCM. Billing information and applicable professional or VAT identifiers are collected when needed for a paid subscription.

Certificate and infrastructure data

We store TLS certificate metadata discovered through public enumeration, local infrastructure scanning, or manual upload. This includes: subject names, issuer details, validity dates, key types, TLS protocol versions, and cipher suites. We do not store private keys.

Usage data

We record platform activity such as sign-ins, configuration changes and alert delivery events. Activity retention is 365 days by default across published plans; a separately agreed organization policy may change it. This is an activity record, not a complete raw history of scans or a guarantee that every event is captured.

Signup handoff data

When you enter a domain on nocert.io, the standard browser launcher carries it to the nocert application in a URL fragment, which is handled by the application and is not sent as part of the HTTP request URL. The no-script fallback opens generic signup without transferring the domain. After the application loads, it validates the domain in a bounded, same-origin JSON request used for handoff reporting. The daily acquisition-counter table records only a global handoff count, without a visitor, device, session, account, organisation, IP-address, or user-agent identifier. A short-lived, in-memory per-IP rate limit separately protects the unauthenticated reporting endpoint from abuse. When nocert's separately controlled domain-alert feature is enabled, the canonical domain may also be sent to nocert's private operations channel hosted by Discord as an unverified, user-supplied handoff, unless your browser sends the Global Privacy Control signal. The domain is not stored in the daily acquisition-counter table. This feature defaults to disabled and will not be enabled until the advance-notice period in Section 11 has elapsed and the message-deletion control described below is operational.

Optional setup emails and monthly summaries

When these options become available in their workspace, owners can separately opt in to setup guidance based on their workspace and to a monthly inventory snapshot. Both choices are off by default. We use the account email address, chosen email language and timezone, and current workspace status to send relevant messages. Our legal basis for these optional messages is your consent (Article 6(1)(a) GDPR). We keep your choices, consent dates and wording versions with your account. The sending queue stores organization and user identifiers, email category, scheduling and attempt timestamps, status and limited error codes for up to 90 days; it does not store email bodies or duplicate recipient addresses. Account deletion removes these records. Optional emails contain a signed unsubscribe link. Unsubscribing stops setup emails and summaries; a message already accepted by the mail server cannot be recalled. You can also change these choices in Settings → Profile. Sign-in codes, requested monitoring alerts and factual notices necessary to manage the account, including trial expiry and the move to Free, continue. We do not add tracking pixels or click-tracking redirects to these messages.

3. Legal basis for processing

  • Contract performance (Art. 6(1)(b) GDPR): processing necessary to deliver the Service.
  • Legitimate interest (Art. 6(1)(f) GDPR): security monitoring, fraud prevention, product improvement, and limited internal awareness of requested signup handoffs.
  • Pre-contractual steps (Art. 6(1)(b) GDPR): opening the signup flow requested after a domain is submitted.
  • Legal obligation (Art. 6(1)(c) GDPR): tax and accounting requirements.

4. Data sharing

We share Customer Personal Data with the following categories of processors. The complete, versioned list under the Data Processing Agreement is available at /legal/dpa/subprocessors.

  • Hosting: OVHcloud SAS (France), for nocert-hosted infrastructure in France and Germany.
  • Edge delivery: Cloudflare, Inc. / Cloudflare Ireland Limited, for CDN, WAF, and DDoS protection. Cloudflare processes requests and limited technical metadata but is not used as the application-data system of record.
  • Payment: Stripe Payments Europe Ltd. (Ireland) and Stripe, Inc. (USA), for payment processing.
  • E-invoicing: Tiime SAS (France), certified French Plateforme Agréée for electronic invoicing under Article 289 bis CGI.
  • Email: Google LLC / Google Ireland Limited (Google Workspace), for business and support correspondence and the application’s current SMTP delivery, including sign-in codes, monitoring alerts, necessary account notices and optional emails. Recipients and message contents are processed to deliver these messages; alert messages can include customer infrastructure details.
  • Additional email provider: Amazon Web Services EMEA SARL / Amazon Web Services, Inc. (Amazon SES). SES may be used for transactional delivery when enabled, subject to the DPA’s provider-change and transfer requirements. It is not the current default SMTP sender.

Separately, when nocert acts as controller for account and pre-contractual acquisition operations, limited data may be disclosed to Discord Netherlands B.V. / Discord Inc. (EEA/USA) as a controller-side recipient and service provider for private operational messaging. Messages may contain account-contact and organisation details; subscription, billing, quota, and other controller-side service-operation signals; global identifier-free acquisition volumes; or, only when the separately controlled feature is enabled, the submitted handoff domain. A handoff notification itself contains no email address, cookie, session identifier, IP address, or user-agent value from that request. Generic service-operation alerts exclude Customer Data such as monitored domains, certificate details, Sentinel hostnames or labels, and customer infrastructure metadata. Discord is not represented as a sub-processor processing Customer Personal Data under the DPA and therefore does not appear in the linked sub-processor register.

We do not sell personal data or use it for third-party advertising or AI model training, fine-tuning or evaluation. With your separate consent, setup emails use the current state of your workspace to select a relevant message. This selection does not make a decision with legal or similarly significant effects on you.

5. International transfers

Core hosted application data is held on OVHcloud in France and Germany. Email, edge and payment providers can process data outside the EEA; EU core hosting does not mean that every processing operation stays in the EU. Transfers require an applicable adequacy decision under Article 45 GDPR, such as DPF coverage for a currently certified recipient and covered service, or an Article 46 safeguard such as applicable SCCs with the necessary assessment and supplementary measures. These are alternatives selected according to the actual recipient, service and transfer, not a blanket certification of NoCert. The provider register describes their roles.

Discord may process limited controller-side operational-message data in the United States. For that separate disclosure, applicable safeguards include Discord's EU-US Data Privacy Framework participation and Standard Contractual Clauses as described in its privacy policy.

6. Data retention

  • Account and Customer Data: ending a paid subscription alone means the workspace continues on Free; it does not start deletion. On termination of the hosted Service, Section 16 of the Terms provides a sixty-day retrieval period, extended where needed to preserve at least thirty days after a Switching transition. Data is then deleted from production and backups expire within thirty days. A lawful earlier erasure instruction is handled without undue delay, subject to legal retention. Self-hosted data controlled solely by the Customer remains its responsibility.
  • Trial and Free Plan accounts: an account not converted to a paid Plan continues on the Free Plan under Section 4 of the Terms of Service: monitoring continues within the Free Plan allowances and no data is deleted on a schedule. Deletion occurs on the account holder’s request or upon termination, following the regime in Section 16 of the Terms (deletion from production, then from backups within 30 days).
  • Certificate data: retained while the associated monitoring target is active; deleted upon target removal or on termination under the regime above.
  • Activity logs: retained for 365 days by default, subject to a separately agreed organization retention policy and account deletion. Product measurement events and optional email queue records have their separate 90-day limits described above. Retention in infrastructure controlled solely by a self-hosted Customer is managed by that Customer.
  • Billing records: retained for 10 years per French accounting law (Article L123-22 Code de commerce); tax supporting documents retained 6 years per Article L102 B Livre des procédures fiscales.
  • Aggregate acquisition counters: daily global counts are retained for up to 13 months and then deleted automatically. They contain no submitted domain or visitor identifier.

nocert does not keep a database copy of a submitted handoff domain. When such a handoff alert is sent, nocert stores only the Discord message identifier, the non-secret webhook identifier needed to target deletion, and lifecycle metadata. It schedules the visible message for deletion no later than 30 days after delivery. No webhook token or domain is stored in that lifecycle table. Access to that channel is restricted to nocert operators. Discord may retain residual backup copies under its own documented retention practices after the visible message is deleted.

7. Your rights

Under the GDPR, you have the right to:

  • Access your personal data (Art. 15)
  • Rectify inaccurate data (Art. 16)
  • Request erasure (Art. 17)
  • Restrict processing (Art. 18)
  • Data portability (Art. 20)
  • Object to processing (Art. 21)

No automated decision-making. We do not carry out automated individual decision-making, including profiling, within the meaning of Article 22 GDPR. The compliance scores and alerts produced by the Service are informational and do not produce legal or similarly significant effects on you within the meaning of that article.

To exercise these rights, contact . We will respond within one month of receipt of the request, in accordance with Article 12(3) GDPR. You also have the right to lodge a complaint with the CNIL ( www.cnil.fr ).

Post-mortem directives (French residents). Under Article 85 of the French Loi Informatique et Libertés, you may issue instructions on the fate of your personal data after your death. You can transmit these instructions to us directly at or register them with a trusted digital third party certified by CNIL.

8. Security measures

  • AES-256-GCM encryption for sensitive fields at the application layer
  • TLS 1.2 minimum for customer-facing web/API and Sentinel API connections; TLS 1.3 preferred where supported
  • Argon2id password hashing
  • Role-based access control with session-based authentication
  • Agent communication secured via RFC 9421 HTTP signatures
  • Cloudflare WAF and DDoS mitigation at the edge

Personal data breaches: where we act as controller, we document breaches and notify the competent authority without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to create a risk to individuals’ rights and freedoms (Article 33 GDPR). High-risk breaches are communicated to affected individuals without undue delay, subject to Article 34 exceptions. For Customer Personal Data processed on instructions, the DPA requires notice to the Customer without undue delay and within 48 hours; that contractual maximum does not authorise waiting when earlier notice is possible.

9. Cookies

The application uses necessary authentication cookies with HttpOnly, Secure and SameSite=Strict attributes. We do not use third-party advertising cookies. Separately, when visit measurement is available on nocert.io, we ask for your consent before recording a short navigation history. It includes known pages, language, named actions, technical error categories, an estimated country and a broad referral category. We do not include form entries, full IP addresses, URL query strings or fragments in these visit records. A random identifier is held in your tab and renewed after 30 minutes of inactivity, with a maximum visit duration of 24 hours. Detailed visits are kept in the live database for 30 days and are not linked to your account. Backup copies follow their separate rotation schedule. When restoring a backup, we clear visit records before reopening access to them. Your accept or refuse choice is valid for six months in this browser. You can change it using Visit measurement in the footer. Stopping measurement also requests deletion of the current visit; if the network is unavailable, we retry when it returns or on a later page load in the same tab. A hashed deletion marker remains for up to 30 days to reject delayed events. Global Privacy Control disables optional visit measurement. Refusing does not prevent use of the site. This processing relies on consent under Article 6(1)(a) GDPR and is separate from the technical request logs used for security.

The signup-handoff counter is server-side and aggregate-only. It does not set or read a cookie, local-storage value, session-storage value, or visitor identifier. When Global Privacy Control is enabled, the aggregate count is still recorded but the domain is not sent to the Discord operations channel.

The platform is fronted by Cloudflare for edge delivery and bot protection. Cloudflare may set strictly necessary technical cookies, in particular __cf_bm (bot-management cookie, lifespan up to 30 minutes) and, when a security challenge is presented, cf_clearance (challenge-result cookie). These cookies are used solely to distinguish legitimate visitors from bots and to record the result of a security challenge. They are exempt from prior consent under CNIL guidance because they are strictly necessary to provide a service expressly requested by the user.

10. Anonymised aggregates and threat intelligence

We may derive anonymised and aggregated statistics from Customer Data collected through the Service (for example: distributions of cipher suites, TLS protocol adoption rates, post-quantum readiness across sectors, certificate authority market share). Before any such use, we run and document a re-identification risk assessment following the CNIL and former Article 29 Working Party methodology (singling-out, linkability, inference).

Data that can still identify a person, including by reasonable linkage or inference, is not anonymous. It is not published as anonymous statistics or treated as exempt from the GDPR. A separate controller purpose requires a documented lawful basis and the required information before processing; publishing this policy does not by itself authorise reuse of Customer Personal Data.

  • Purposes: product improvement; publication of sectoral threat-intelligence insights and TLS ecosystem research.
  • Legal basis: legitimate interest (Article 6(1)(f) GDPR), namely the legitimate interest of nocert and of the security community in understanding the TLS ecosystem and improving the Service.
  • Recipients: nocert internal teams; readers of any published threat-intelligence report.
  • Retention: aggregated statistics may be retained indefinitely as they no longer identify individuals.
  • Right to object: you may object to this processing at any time by contacting , in accordance with Article 21 GDPR.

We do not use personal data, whether raw or aggregated, to train, fine-tune, or evaluate artificial intelligence or machine-learning models.

11. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email at least 30 days before they take effect. The "Last updated" date at the top reflects the most recent revision.

On this page