Privacy and security commitments

Product commitments

  • Personal searches require the account owner's authorization.
  • Discovery sends only a name and optional city and company. Search snippets are discarded after screening.
  • Possible matches require identity confirmation. A reviewer can dismiss a mismatch or return it to the person, but can never confirm identity.
  • Removal requests require owner approval and a verified recipient.
  • A sent request never counts as a removal.
  • Source snapshots are encrypted, owner-only, deletable and displayed as inert evidence; source scripts never run.
  • Scam Check never labels a message safe or stores raw message text.
  • Company findings require exact-domain ownership verification.
  • Displayed findings include a source and collection time when available.

Removal requests

Hide records approval, delivery, replies, escalation and verified removal separately. Hide never emails or stores identity documents. The owner completes required identity checks directly with the source. A public source is checked again before a removal is recorded. Register cases may require correction, restriction or objection instead of erasure.

Public scanner safety

Vendor Check and Scam Check reject private, local and reserved network targets. Requests use strict timeouts and redirect limits. Scam Check traces links with HEAD requests and does not download page bodies. Private Exposure Ledger context is attached only as aggregate counts, categories and domain overlap. An overlap provides context for investigation; it does not prove identity or compromise.

Hide Engine data flow

Each surface sends only the fields needed for its check. Outlook and Gmail access the current message only after the user starts a check. The mobile share target sends reviewed text or a link. The browser extension sends a hostname and three page signals, without the URL path or browsing history.

  • Raw messages and images are processed in memory and excluded from check history.
  • History keeps the verdict, category, signal identifiers, timestamp, content hash and surface.
  • Feedback stores the outcome and signal identifiers, without restoring submitted content.
  • Customer content is not used to train models.
  • Workspace context requires membership in the exact verified workspace.

Microsoft 365 background protection requires tenant-admin consent, a verified workspace domain and an approved application access policy. It scans selected function mailboxes only. Alerts exclude subject, body, attachments and invoice content.

Hosting and sub-processors

The production application and PostgreSQL database run in Railway's EU West region in Amsterdam, Netherlands. They were moved from US West on 26 September 2026. Railway does not currently offer a Frankfurt region, and this deployment does not yet provide the specification's separate EU secondary region. Hide therefore does not describe the complete service as Frankfurt-primary or transfer-free.

  • Railway: application hosting and PostgreSQL in Amsterdam for the current production deployment.
  • Google Web Risk: optional URL threat-list lookup when configured; submitted URL only.
  • Resend: transactional email delivery for account and product notices.
  • Twilio: optional one-time SMS delivery after the account owner explicitly requests phone verification; the destination number and message are sent only for that verification.
  • Stripe: subscription payment and billing records when a person purchases a plan.
  • Serper through a Vercel gateway: bounded public-search results for separately authorized Exposure Check discovery.

Before a new processor handles customer data, Hide must record its purpose, region, contract and transfer mechanism and notify affected business customers of a material change.

Trust documents

These documents are operational drafts for customer review. They are not signed agreements and have not yet completed the external legal-review gate required before background employee-mailbox scanning launches.

Application security

  • Sign-in codes, session tokens and result-management tokens are stored as cryptographic hashes.
  • Every sign-in requires a short-lived, single-use code sent to the account email. Codes are rate-limited and expire after ten minutes.
  • A privacy-minimal security email is sent after a new session is created. Hide shows its delivery state without collecting an IP address, location, device name or browser fingerprint.
  • People can review active-session times and revoke one or every other session. Hide does not collect IP addresses or browser fingerprints for this list.
  • Personal account closure requires both a current session and a separate 30-minute, single-use email link. The database operation is guarded against replay, signs out every device and will not run while billing, refund review or shared organization access remains unresolved.
  • Organization records are scoped by organization identifiers and server-side permission checks.
  • Payment webhook signatures are verified before entitlement changes.
  • Secrets belong in hosted environment configuration, not source code or analytics.
  • Security headers limit framing, browser capabilities and unnecessary content sources.

Monitoring

Monitoring checks only confirmed public sources. A change requires owner review and never proves that personal data returned. If email delivery fails, source checks and private-ledger evidence continue. Recurring discovery is opt-in, runs every 30 days and never triggers removal automatically. The monthly summary is deliberately privacy-minimal and contains counts only.

Retention

Browser-only exposure cases expire after 30 days. Indicator hashes contributed through a separate explicit choice expire within 90 days, remain attributable only so their owner can withdraw them, and are removed with personal account closure; an ordinary check does not contribute them. Vendor reports expire after 90 days. Personal check records remain for up to 12 months. Company workspaces choose 90 days to seven years; the default is three years. Rate-limit identifiers are actively deleted when their counter window expires, never later than 24 hours. Railway platform logs remain for 30 days. Account owners can delete cases sooner. See the privacy notice.

Report a vulnerability

Send a concise description and reproduction steps to info@hidedata.app. Do not access data that is not yours, disrupt availability or use social engineering. We will acknowledge good-faith reports and coordinate remediation.