1. Who we are and our roles
TasScan is operated by TAS Group LLC, a Wyoming limited liability company ("TAS Group", "we", "us"). This Privacy Policy explains how we handle personal information when you visit our websites, create an account, use the TasScan platform and mobile application, or contact us.
- Controller. For personal information about website visitors, account holders, administrators, billing contacts and people who contact us, and for security, abuse-prevention and legal-compliance records, TAS Group LLC is the controller (or, under U.S. state laws, the "business").
- Processor. For personal information contained in Customer Data that a customer organization submits to or generates in TasScan (for example assets, scan results, findings, comments and attachments), the customer organization is the controller and TAS Group LLC acts as its processor (or "service provider") under the Data Processing Addendum and the Terms of Service. If you are a member of a customer organization, that organization's own privacy notice also applies.
To reach us about privacy, use the official contact page.
2. Information we collect
| Category | What it includes |
|---|---|
| Account Information | First and last name, business email address, phone number, company name, country, role and marketing preference. |
| Authentication Information | Password hash (we do not store your password), multi-factor and passkey registrations, authenticator and recovery-code data, device and session identifiers, sign-in times, IP addresses and user agents, and push-approval device tokens. |
| Organization Information | Organization name, size, industry, members and roles, invitations, settings and agreements accepted. |
| Asset Information | Domains, hostnames, IP addresses, URLs, tags, criticality, ownership-verification tokens and state. |
| Scan Information | Scan configuration and profiles, requests and responses observed during scans (including headers and excerpts of content), findings, evidence, monitoring results, reports and history. |
| Authorization Records | Records of each Authorized Security Testing confirmation: user, organization, asset, verification state, scan profile and scope, timestamp, source IP address, user agent and agreement version; and acceptance records for our Terms and Privacy Policy. |
| Support Information | Tickets, messages, attachments and contact-form submissions (name, email, company, topic and message). |
| Billing Information | Plan and subscription details, billing contact and invoices. Card and payment details are collected and held by our payment processor, not by us. |
| Website/Technical Information | IP address, browser type, device information, pages requested, security and error logs, and cookies and similar technologies described in the Cookie Policy. The free Security Check records the domain checked and a hashed rate-limit key. |
3. Where information comes from
We collect information from you (when you register, configure assets, start scans, contact us or pay); automatically from your use of the Service and your devices and browsers; from other users in your organization (for example invitations and shared assets); from the systems you ask us to test (scan results); and from service providers (for example payment, email-delivery and infrastructure providers) and public sources such as DNS records for domains you add.
4. How we use information
We use personal information to:
- provide, operate and support the Service;
- authenticate users and secure accounts (including multi-factor authentication and device checks);
- manage organizations, roles, invitations and agreements;
- verify asset ownership and enforce authorization controls;
- perform scans, monitoring and discovery, and analyze and report results;
- generate findings, notifications and reports;
- prevent abuse, fraud and unauthorized scanning, and enforce our policies;
- protect the security and integrity of the Service, and detect and respond to incidents;
- answer support requests and communicate about the Service;
- administer subscriptions, billing and taxes;
- comply with legal obligations and respond to lawful requests; and
- maintain and improve product reliability and performance.
5. Legal bases (EEA, UK and similar laws)
Where the GDPR or UK GDPR applies to us as controller, we rely on:
- Contract: to provide the Service you request and to take steps before you enter into a contract (account, authentication, scanning, support, billing);
- Legitimate interests: to secure and operate the Service, prevent abuse and unauthorized scanning, keep authorization records, support and improve reliability, and defend legal claims, where those interests are not overridden by your rights;
- Legal obligation: to meet tax, accounting, compliance and lawful-request obligations; and
- Consent: where required, for example optional marketing email and any non-essential cookies or similar technologies. You can withdraw consent at any time without affecting earlier processing.
6. Scan results may contain personal or sensitive information
Targets you authorize us to scan may expose personal or sensitive information in their responses, for example email addresses in a page, or credentials and tokens mistakenly published. TasScan is designed to minimize what it stores and attempts to redact secrets from stored evidence, including authorization headers, cookies, API keys, tokens, passwords, session identifiers and private keys. Redaction may not catch every case. Customers should avoid scanning in a way that is intended to collect personal data, and should treat any secret exposed in a finding as compromised. We do not use scan evidence to build profiles of individuals.
7. Automated security decisions
Some security decisions are made by automated means, for example blocking a target or request that fails our network-safety checks, rate-limiting or locking sign-in attempts, requiring additional verification, and stopping a scan or restricting an account when abuse signals are detected. These decisions are aimed at protecting the Service, our customers and third parties. Decisions to suspend or terminate an account for serious or repeated violations involve human review. You can ask for a human review of any automated security decision by contacting us.
8. Who we share information with
We share personal information only as needed, with:
- customer organization members and administrators (within your organization);
- service providers (subprocessors) that act on our behalf under contract, in these categories: cloud hosting and infrastructure; content delivery and attack protection; email delivery; object storage and encrypted off-site backup; payment processing (when billing is enabled); push-notification delivery to the mobile app; error monitoring; and uptime and heartbeat monitoring. A current list is available on request and is described in the Data Processing Addendum;
- professional advisers (legal, accounting, insurance) under confidentiality;
- authorities and affected parties when required by law, to protect rights and safety, or to address misuse of the Service (for example disclosing an authorization record to the owner of an affected system or its provider); and
- a successor in a merger, acquisition or sale of assets, with notice where required.
We do not sell personal information for monetary consideration. We do not currently use personal information for cross-context behavioral advertising or share it for that purpose, and we do not use third-party advertising or analytics cookies.
9. International transfers
TAS Group LLC is based in the United States, and our infrastructure and service providers may be located in the United States, the European Union or elsewhere. When personal information from the European Economic Area (EEA), the United Kingdom or Switzerland is transferred to a country that has not been recognized as providing adequate protection, we use an appropriate transfer mechanism, such as the EU Standard Contractual Clauses approved by the European Commission and, for the UK, the UK International Data Transfer Addendum to those clauses or a successor mechanism recognized under UK law, together with supplementary measures where appropriate. The Data Processing Addendum incorporates these mechanisms for customer personal data. You may request information about the safeguards we use through our contact page.
10. Retention
We keep personal information only as long as needed for the purposes described, and then delete or de-identify it. In general:
- Account Information is kept for the life of the account and a short period after closure.
- Authentication and security events and audit records are kept for as long as needed for security and legal defensibility, then minimized.
- Raw scan results are kept for 30 to 90 days depending on plan; findings and history are kept for the life of the organization, unless deleted earlier.
- Free Security Check results are kept for a short, limited period (24 hours by default, set by the platform operator); each result shows its expiry and is then deleted.
- Support tickets are kept for the life of the organization; contact-form messages are kept for 12 months.
- Authorization Records and acceptance records are kept as long as needed to evidence authorization and to defend or investigate claims.
- When an organization is closed, organization data, stored files, memberships and sessions are deleted at the end of a restoration period (30 days by default); members who belong to no other organization have their name, email address and phone number removed. Backups expire on their normal cycle.
Retention may be longer where the law requires or a legal claim or investigation is pending.
11. Security
We use technical and organizational measures designed to protect personal information, which may include encryption in transit, hashed passwords, access controls and role separation, multi-factor authentication options, network-safety controls, logging and monitoring, and encrypted backups, as described on our Security page. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
12. Incident notification
If we become aware of a personal data breach affecting information we handle, we will notify affected customers and individuals and the relevant regulators without undue delay and as required by applicable law. Where we act as a processor, we will notify the controller as set out in the Data Processing Addendum.
13. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your personal information, to receive a portable copy, and to withdraw consent. You can also lodge a complaint with your data-protection authority (in the UK, the Information Commissioner's Office; in the EEA, your local supervisory authority). To exercise a right, contact us using the official contact page. We may need to verify your identity, and we will respond within the time required by law. If your information is held in a customer organization's workspace, we will redirect the request to that organization, which is the controller; members should contact their organization administrator first.
14. U.S. state privacy rights
Residents of certain U.S. states (including California, Colorado, Connecticut, Virginia, Utah, Texas and others) may have the right to know and access the personal information we hold, correct it, delete it, obtain a copy, and opt out of its sale, of targeted advertising and of certain profiling. We do not sell personal information for monetary consideration, we do not currently engage in targeted or cross-context behavioral advertising, and we do not knowingly sell or share the personal information of anyone under 18. We do not use or disclose sensitive personal information for purposes that would require a right to limit. We will not discriminate against you for exercising these rights. You may authorize an agent to make a request and may appeal a refusal by replying to our response. Where we act as a service provider, we process Customer Personal Data only on the customer's instructions.
15. Children
TasScan is a business service and is not intended for people under 18. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided us information, contact us and we will delete it.
16. Cookies
We use only cookies and browser storage that are strictly necessary or that record choices you make, and we do not use cookies for cross-site behavioral advertising. See the Cookie Policy.
17. Marketing
We send product and security communications needed for the Service. If you opt in to occasional product updates you can unsubscribe at any time from the email or your settings.
18. Changes to this Privacy Policy
We may update this Privacy Policy by posting a new version with an effective date. For material changes we will notify account holders by email or in the product, and where required we will ask you to accept the new version.