Privacy Policy

1. Overview

This policy describes what ProofKit ("we", "us") collects and how it is used. The short version: we collect what is needed to run the service, we do not sell your data, and we do not run ads or third-party trackers.

2. What we collect

Account data. Your email address and a hashed version of your password. Passwords are stored using scrypt hashing and are never stored in plain text.

Azure connection data. The tenant ID, client ID and subscription ID you connect. The client secret is encrypted at rest and is never shown again once saved.

Evidence data. The resource facts ProofKit reads from Azure to answer each posture check: resource names, IDs, configuration values, and the counts and summaries derived from them. This is read-only data about your Azure environment, kept so runs can be compared over time and exported as an evidence pack.

Logs. Standard server logs, including IP address, request path, and timestamp, kept for security and debugging.

3. Cookies

ProofKit sets a single signed session cookie so you stay logged in. There are no advertising cookies, analytics trackers, or fingerprinting.

4. Payments

Paid plans are billed by Stripe. Your card details go directly to Stripe and never touch our servers. We receive only your subscription status and a Stripe customer reference.

5. Service providers

We use a small number of providers to run ProofKit: Microsoft Azure, whose APIs ProofKit reads on your behalf using the credentials you provide; Stripe for payments; Cloudflare for networking and DDoS protection; and Resend for transactional email. Data is stored on servers in the United States. We share data with these providers only as needed to operate the service.

6. How we use data

To provide the service, secure it, fix problems, and communicate with you about your account. We do not sell personal data and we do not use your evidence data or Azure configuration to train AI models.

7. Retention and deletion

Your data is kept while your account is active. Deleting your account from Settings removes your subscriptions, run history, evidence and stored Azure credentials immediately, except minimal records we must keep for legal or billing reasons.

8. Security

All traffic is encrypted over HTTPS, passwords are hashed with scrypt, Azure client secrets are encrypted at rest, and access to production systems is restricted. No system is perfectly secure, so use a strong, unique password.

9. Children

ProofKit is a business tool and is not directed at children under 16. We do not knowingly collect their data.

10. Changes

If this policy changes materially, we will note it here and update the effective date.

11. Contact

Privacy questions or requests: [email protected].