Privacy Policy

Introduction

CyberScore is a free cybersecurity assessment tool operated by CyberSecurity NonProfit (CSNP), a 501(c)(3) non-profit organization. This Privacy Policy describes how we collect, use, store, and protect your information when you use CyberScore.

CyberScore is in beta. Features, scores and pages can change while we build; the retention periods and your right to delete your account in this policy apply during the beta as written.

By using CyberScore, you agree to the collection and use of information as described in this policy. If you do not agree, please discontinue use of the service.

Data We Collect

We collect the minimum data necessary to provide the CyberScore service. Where possible, we anonymize data at the point of collection:

• Account information: Name, email address, and organization name provided during registration; you can change or clear your name and location in Settings. Any name, city, employer and usernames you type into a footprint check are searched only for an email address you have verified. They are not saved to your profile; they appear only in the action items the check creates for you, such as an opt-out email drafted in your name, and are removed when you delete your account. To have saved usernames removed sooner, email privacy@csnp.org.
• Age confirmation: The date and time you confirmed that you are 13 or older, and the version of the statement you confirmed. We do not collect a date of birth, an age or an identity document.
• Email addresses submitted for scanning: Personal email addresses you submit to check against known data breaches. Email addresses are stored in masked form (e.g., j***@example.com) and looked up using one-way cryptographic hashes (SHA-256). We do not retain your full plaintext email address in scan records. This is the same with or without an account. A check run while signed out is stored the same way, with its score and the breaches found, is linked to no account, shows you the score, the number of breaches and general advice without breach names, and is deleted after 6 months.
• Verified email addresses: An address you verify with a code sent to that inbox is stored in masked form (for example abc***@example.org) together with a one-way hash, so CyberScore can recognize it again without keeping the full address.
• Monitored email addresses: An address you add to breach monitoring is stored encrypted, in full, because checking for new breaches needs the actual address; a masked copy is kept for display.
• Domain names: Business domains you submit for security analysis, including DNS, TLS, and email security configuration checks.
• Employee email breach data: For verified business domains, the domain owner may provide employee email addresses to check against known breach databases. These addresses are stored while the domain claim remains active, because monitoring requires the actual address. They are removed when the claim is removed, and unverified claims have their employee lists deleted automatically after 30 days of inactivity.
• Scan results: Security assessment results generated from your submitted data.
• Usage data: Error logs and performance data collected through our error monitoring service to maintain service reliability.

How We Use Your Data

• To perform cybersecurity assessments and generate your CyberScore.
• To provide personalized security recommendations and action plans.
• To search for your name, city, employer and usernames only for an email address you have verified from your account, and to show what we find only to that account. Without an account, a check returns your score, the number of breaches and general advice, and no breach names.
• To send notifications about new breaches affecting addresses you monitor. Monitoring runs only for an address you have shown is yours: the address you sign in with, or any other address after a code sent to that inbox.
• To maintain and improve the CyberScore service.
• To produce aggregate figures for CSNP impact reporting to donors and grant providers, shared with the CSNP tool that prepares funding applications: the total number of checks run, and, for a named breach, how many distinct addresses checked here appeared in it, given only when at least 5 addresses are affected, rounded down to a multiple of 5, and never for breaches marked sensitive. These figures contain no addresses, names or scan results.

What We Do Not Do

• We do not sell, rent, or trade your personal data to any third party.
• We do not use your data for advertising or marketing purposes.
• We do not share individual scan results with any third party without your explicit consent.

Third-Party Services

CyberScore integrates with the following third-party services to provide its functionality. Each service processes only the minimum data required for its specific purpose:

Each third-party service is governed by its own privacy policy. We encourage you to review their policies independently.

Data Retention

• Personal scan data: Personal breach scan results are automatically and permanently deleted after 6 months. This deletion is performed daily by an automated process and cannot be reversed.
• Business scan data: Business domain scan results are retained to provide historical comparison and trend analysis for your account. Employee email details inside scan results older than 6 months are removed automatically; the scores and counts are kept. You may delete your entire account at any time.
• Employee breach data: Cached employee breach lookup results are deleted after 90 days. Employee email lists on unverified business claims are deleted automatically after 30 days of inactivity.
• Monitored addresses: Kept while the entry is active. An address added before confirmation was required is deleted 30 days after we send its confirmation email, or after the same period where no email can be sent, if no code is entered.
• Verification codes: A code works for 10 minutes. Its record is removed by a daily sweep once it is more than 24 hours old, whether or not it was used.
• Account data: Account data is retained for as long as your account remains active.
• Account deletion: You may delete your account at any time through the Settings page. Deletion permanently removes your account data, scan results, action items and monitored addresses, and any check run on your account's addresses while you were signed out.
• Anonymized data: Anonymized, aggregated data used for impact reporting may be retained after account deletion, as it contains no personally identifiable information.

Data Security

We implement technical and organizational measures to protect your data, including:

• Email addresses in scan records are masked at the point of storage and looked up using irreversible cryptographic hashes (SHA-256), so plaintext email addresses are not retained in our database.
• Automated data retention enforcement permanently deletes personal scan data older than 6 months.
• Row-level security policies ensure users can only access their own data.
• Every API endpoint is rate-limited, or accepts only a secret held by our own systems.

For detailed information about our security practices, please see our Security page.

Your Rights

You have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Delete your account and all associated data through the Settings page.
• Export your scan results and data.
• Opt out of non-essential communications at any time.

Children's Privacy

CyberScore is not directed at individuals under the age of 13. When you create an account, you confirm that you are 13 or older. An account created before we asked confirms at its next visit. We record the date and time of that confirmation and the version of the statement you confirmed. We do not collect a date of birth, an age or an identity document. The record is deleted with your account. We do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has given us personal data, email privacy@csnp.org and we will delete it.

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. Continued use of CyberScore after changes constitutes acceptance of the revised policy.

Contact

For questions or concerns about this Privacy Policy or your data, contact us at privacy@csnp.org.