Fortifie Privacy Policy

Last updated: November 15, 2026

Effective date: November 15, 2026

Controller: [Legal entity name], [business address].

This policy describes what Fortifie collects, why, how long we keep it, and your choices. It covers the public website, customer accounts, the dashboard, the Hardening MCP, and related infrastructure.

We try to collect only what we need to run the product. We do not sell personal information.

1. What we collect

Account and sign-in. Email address, session cookies, and sign-in events. We sign you in with a one-time link sent to that address. We do not store an account password because we do not use passwords.

Billing. If you buy a plan, Stripe processes payment details. We receive limited billing information (for example, customer and subscription identifiers, plan, payment status). We do not store full card numbers on our systems.

Uploads. Files you submit for a scan or a hardening run, a SHA-256 of the file, the file name, and job status. Uploads are processed to provide the Service (static analysis and, when authorized, hardening). They are not launched as running applications.

API keys. If you create a Hardening MCP key, we store a fingerprint (hash) of the key, not the secret itself, so we can validate and revoke it. The secret is shown once.

Usage. Counts of hardening runs against your plan quota, job identifiers, and timestamps. This is how we apply plan limits.

Operator review records. If a run needs a person at Fortifie to review it, we keep the job record and the reason it was held, so the review can be completed or declined.

Website. Standard request logs (IP address, time, user agent, path) used to operate and secure the site. The public homepage assessment path is an email you send to [email protected]; that email is ordinary business mail.

Heartbeat telemetry (licensed apps, when enabled). For some licensed applications, a customer may enable a periodic heartbeat back to Fortifie. This is minimal: it is meant to support licence and evidence checks, not to profile end users. It is not a geolocation product (we do not use GeoIP for this). Heartbeats are not on by default for every customer, and we do not use them as a marketing dataset. A fuller description of what a given product build actually sends, if anything, will be disclosed in that product’s own documentation when the feature is offered to customers.

We do not collect government identifiers, precise device location, or payment card PAN/CVC on our own servers.

2. Why we use this information

To create and secure your account, and to send the sign-in link (the only email the Service sends automatically).
To scan and harden files you upload, and to show status and (when completed) a download.
To apply plan quotas, bill you, and handle tax and accounting where required.
To review jobs that the product holds for a human decision.
To keep the Service reliable and secure, and to investigate abuse.
To communicate with you about your account when you ask, or when we must (for example, a material change to this policy).

We do not send marketing email automatically from the account Service. We do not use uploads to train public models.

3. How long we keep it

Uploads (files): held for a maximum of 7 days. After a scan is finished, the uploaded file is deleted. After a hardening job finishes (including a failed, blocked, or held job), we delete the uploaded file as soon as we no longer need it to finish or review that job, and in any event within 7 days of upload. Hardened output, when it exists, is also not kept indefinitely; it is available for download for a limited period and is then deleted, within that same 7-day ceiling unless a held review reasonably requires a short extension, which will still be measured in days, not months.
Job and audit records (status, SHA-256, reason a job was held or refused, without the file): kept as needed to support the account, quotas, and operator review, then deleted or minimized. We do not keep these as a copy of your source.
Account and billing records: kept for the life of the account and for a limited period afterward as tax, accounting, and fraud-prevention laws require.
Sign-in links and sessions: short-lived (sign-in links expire in minutes; sessions expire and can be signed out).
API key fingerprints: kept until you revoke the key or close the account, then deleted.
Heartbeat telemetry: minimal records, retained only as long as needed for licence and evidence review. A related licence-call log, if enabled, is designed around a 90-day window; we will not quietly extend that without updating this policy.
Website logs: retained for a short operational period (typically weeks, not years) unless needed for a security investigation.

4. Who we share with

We share information only with processors who help us run the Service, under contracts that limit their use:

Cloud and network hosting for the website, account service, and hardening infrastructure.
Email delivery for the sign-in link (transactional email only).
Stripe for payment and subscription management.
Professional advisors or authorities when the law requires it, or to protect rights and safety.

We do not sell personal information. We do not share uploads with other customers. A person at Fortifie may see an upload or a report only when needed to operate the Service or to complete a human review you were told about.

5. International transfers

Infrastructure may be in the United States or other countries where our processors operate. If you access the Service from elsewhere, your information may be processed in those locations. We will describe additional transfer safeguards here if a later publication requires them (for example, standard contractual clauses).

6. Your choices and rights

You can sign out, revoke API keys, and request account closure at [email protected].
You can ask for a copy of the account information we hold, or ask us to correct or delete it, subject to legal retention duties (for example, invoices).
Depending on where you live, you may have further rights (access, deletion, restriction, objection, portability, or a complaint to a data protection authority). Contact us and we will respond in line with the law that applies.
Heartbeat telemetry, when offered, can be left off; it is not a hidden always-on tracker.

We will not require you to accept marketing in order to use a paid account.

7. Security

We use industry-standard measures appropriate to the data: encrypted transport, hashed API keys, short-lived sign-in links, access limited to systems and people who need it, and fail-closed rules so we do not release a hardened file when a run is not successfully completed. No method is perfect; please use a mailbox only you control for sign-in.

8. Children

The Service is for business and professional use. It is not directed at children, and we do not knowingly collect personal information from children.

9. Changes

If we change this policy in a material way, we will update the effective date, post the new policy when it is published, and, where appropriate, email the address on the account.

10. Contact

Privacy questions or requests: [email protected].

[Legal entity name], [business address].