Privacy Policy

510sec · Last updated 2026-09-22

The short version. We never read your source code. Your device specification is used only to generate your documents. We do not sell your data, we do not use it to train models, and the optional AI features run in Amazon Bedrock inside our AWS account, so the model makers never receive your text.

1. What we collect

Category	What	Why
Account	Name, email, hashed password	To give you a login and support you
Readiness-check leads	Name, work email, company, device description, role, stage, answers, score	To deliver your gap report and follow up about it
Device specifications	Components, interfaces, dataflows, dependency manifests or an SBOM you upload	To generate your pack - this is the product
Generated packs	The documents produced for you	So you can return and download them
Purchases	Order records, amounts, discount codes used	Receipts, accounting, support
Operational logs	Audit events (sign-in, generation, admin actions), error logs	Security and debugging
Usage analytics	Which pages are viewed, which buttons are clicked, the site you arrived from, campaign tags, browser family, and a coarse network identifier derived from your IP address	To see which parts of the product are used and where people get stuck, so we can improve it

1a. Usage analytics, in detail

We measure how the product is used, and we do it in a way that cannot expose your work.

First-party only. Analytics data is stored in our own database. We do not use Google Analytics, Mixpanel, session-replay tools or advertising pixels, and no third party receives anything about your visit. There is no analytics entry on our Subprocessors page because there is no analytics subprocessor.
We record page addresses, not your records. Identifiers are stripped before storage - a visit to your device page is recorded as /app/devices/:id, never with the device number or name. The analytics data cannot be used to work out what you are building or how many devices you have.
When you are signed in, the pages you view are linked to your account, so we can see how each customer uses the product and where they get stuck. Sign-ins are recorded in our audit log.
We never record what you type. No form values, no device specifications, no file names or contents, no search terms, no keystrokes. Clicks are recorded only for elements we have explicitly marked, and only the name of the element.
IP addresses. On this deployment, we reduce it to the surrounding network (203.0.113.47 becomes 203.0.113.0) and store only that. What we keep cannot be traced back to you: two people behind the same office router are the same value to us. This sentence is generated from the running configuration, so it cannot describe a setting we are not actually using.
Retention. Raw analytics events are deleted after 90 days (about 3 months), by the application itself rather than by hand. After that only the totals we have already read remain — we do not keep a per-visitor archive.
Opt out. Email support@510sec.com and we will exclude your account. Blocking /api/v1/events in your browser also works and breaks nothing.

2. What we never collect

Source code. The uploader reads dependency manifests and SBOM files only; when you upload a project ZIP it is scanned in memory for known manifest filenames and nothing else is opened or written to disk. We also do not collect payment card numbers - Square handles those and we receive only a payment status and reference.

The service is not intended to process protected health information (PHI) or patient data. Please do not enter PHI into device descriptions.

3. AI processing

Document generation is performed by a deterministic rule engine on our servers - no AI is involved. The optional "polish" feature rewrites wording only and runs only when you choose it for a run. It uses OpenAI and Anthropic models hosted in Amazon Bedrock, inside our AWS account: only threat-description text is sent, and Amazon Bedrock does not pass it to the model makers. An on-premises installation can use a local model instead. Providers are listed on the Subprocessors page.

4. How we use it

To provide and support the service, process payments, send transactional messages (verification codes, receipts), and - where you gave us your details through the readiness check - to contact you about your results and our product. You can opt out of non-essential contact at any time by replying or emailing us.

We do not sell personal information, and we do not use customer device data to train machine-learning models.

5. Retention

Account, device and pack data are retained while your account is active. Readiness-check leads are retained for up to 24 months. Order records are retained as long as tax and accounting law requires. You can request deletion at any time (section 7).

6. Sharing

Only with the subprocessors that operate the service (hosting, payments, email - see Subprocessors), and where legally compelled. No advertising networks, no data brokers.

7. Your rights

Email support@510sec.com to access, correct, export, or delete your data, or to object to processing. We honour requests from residents of any jurisdiction, regardless of whether a specific statute applies to us, and respond within 30 days.

8. International

The service is hosted in the United States. If you use it from elsewhere, your data is processed in the US.

9. Children

The service is for businesses and is not directed to anyone under 18.

10. Changes

Material changes will be announced in the application and reflected in the date above.