Privacy Policy

Last updated: April 20, 2026

1. Who We Are

CRUCiBLE SECURiTY.com is a product of CRUCiBLE CAPiTAL SYSTEMS LLC ("we," "us," "our"). We provide AI-powered IT security monitoring and threat detection services.

2. Information We Collect

We collect information you provide directly:

Email address (when joining the waitlist or creating an account)
Name and company information (when setting up your security dashboard)
Security telemetry data you choose to connect (logs, alerts, network data)

We automatically collect:

Usage data (pages visited, features used, session duration)
Device and browser information
IP address

3. How We Use Your Information

To provide and improve our security monitoring services
To send you product updates and security advisories
To detect threats, anomalies, and security incidents in your connected systems
To comply with legal obligations

4. Scanner Data Collection

The free external security scanner at CRUCiBLE SECURiTY.com (and the open-source scan.py CLI) analyzes publicly accessible information only:

What we fetch: HTTP response headers, HTML source, DNS records (A, MX, TXT, CAA), SSL/TLS certificate details, and publicly available certificate transparency (CT) log data via crt.sh.
What we do NOT access: authenticated endpoints, private data, credentials, admin panels, internal networks, or anything not publicly reachable by any web browser or researcher.
Scan results: when you run a scan, the URL, score, grade, and full findings breakdown are stored in our database and are visible only to you when logged in as your account. Admin accounts within CRUCiBLE CAPiTAL SYSTEMS LLC can see all scan results for platform monitoring purposes.
OSS CLI telemetry: the open-source scan.py tool sends an anonymized summary (score, grade, per-category pass/fail counts, detected tech stack) to CRUCiBLE SECURiTY.com by default. No URL, hostname, or identifying information is included. You can opt out by setting TELEMETRY=false in your environment or by passing --no-telemetry.

5. Security Telemetry Data

Security logs, network traffic data, and endpoint telemetry you connect to CRUCiBLE SECURiTY.com are processed solely for the purpose of providing security analysis. We do not sell, share, or use your security telemetry for advertising or any purpose other than delivering our security services to you.

6. Data Retention

Security telemetry is retained according to your plan tier (7 days for Scout, 30 days for Sentinel, 1 year for Enterprise). You can request deletion at any time.

7. Third-Party Services

We use Supabase for authentication and data storage, Anthropic's Claude API for AI analysis, and Vercel for hosting. Each processes data under their own privacy policies.

8. Analytics and Session Recording

We use PostHog for product analytics and session recording to improve our platform. This includes anonymized tracking of page views, clicks, and user interactions. Session recordings capture mouse movements, clicks, and scrolling behavior to help us identify and fix usability issues. Sensitive fields such as passwords, credit card numbers, and personal financial data are automatically masked and never recorded. You can opt out of session recording at any time in your account settings. Data is processed by PostHog Inc. in accordance with their privacy policy.

9. Your Rights

You may request access to, correction of, or deletion of your personal data at any time by contacting us.

10. Contact

Email: shawwe@alumni.vcu.edu

CRUCiBLE CAPiTAL SYSTEMS LLC