Privacy statement

Who is responsible

If you run FullyQualified yourself, you or your organization is the controller of the data in your installation. The FullyQualified project never receives data from it.

For the planned hosted service, the operating company [company name, address, registration number, contact email] is the controller of account data, and the processor of the monitoring data that its customers put in.

This website

The website is static. It sets no cookies and uses no analytics, tracking pixels, third-party fonts, embeds or scripts. The web server that delivers it may log technical request data such as the IP address, the page, the time and the browser, for security and operation [hosting provider and retention period to be stated].

What the application stores

• Accounts: name, optional email address, role, organization (tenant), registration time and last sign-in time.
• Sign-in: the public key and identifier of each passkey. The private key never leaves your device, and no passwords or biometric data reach the server. With single sign-on: the identifier your identity provider assigns, and your email address.
• Organization data: the name of the organization, the domains and hostnames you monitor, the results of the checks (certificate details such as issuer and expiry date, DNS record values), detected changes and your alarm settings. Webhook addresses are stored encrypted.
• Logs: which alarms were sent to which channel, and whether it worked.
• Cookies: only what the application needs: a session cookie after you sign in, a short-lived cookie during sign-in (five minutes) and your language choice. There are no advertising or analytics cookies.

Public sources

Checks use public information and connections you ask for: DNS queries, TLS handshakes with the endpoints you add, and Certificate Transparency logs. When you use Find subdomains, the domain name you search for is sent to the Certificate Transparency search at crt.sh, or to Cert Spotter (SSLMate) when crt.sh is unavailable. This never happens by itself. To detect DNS tampering, DNS queries for the domains you monitor are also sent to the public resolvers of Cloudflare (1.1.1.1), Quad9 (9.9.9.9) and Google (8.8.8.8); you can change or turn this off in your installation.

The free check

When you use the free check on this website, the domain name you type is sent to our checker, which looks at the certificate on port 443 and at the public DNS records and shows you the result. Nothing is stored. Your IP address is kept in memory for up to an hour to limit how often one address can check, and is not written to disk or to logs [to be confirmed for the hosting setup].

Why and on what basis

• To provide the service you asked for (performance of a contract).
• To keep the service secure and prevent abuse (legitimate interest).
• To meet legal obligations, such as accounting (legal obligation).

Who receives data

We do not sell data and we do not use it for advertising. Service providers process data on our behalf: hosting [Scaleway, EU, to be confirmed] and email delivery [provider to be named]. Alarms contain the details of a result and are sent to the Slack, Telegram, webhook or email address that your administrator configured. [Transfers outside the European Economic Area: none planned; to be confirmed with the providers.]

How long data is kept

Results, changes and alarm logs are kept for the history period of your plan, for example one month on Free and twelve months on Starter [final periods to be set]; the newest result of every check is always kept. Deleting an organization removes all its data at once. Invitations expire after 7 days, recovery links after 24 hours and sign-in challenges after five minutes. When an organization ends its subscription, its data is deleted [within a period to be stated].

Your rights

You can ask for access to your data, correction, deletion, restriction of processing, a copy in a usable format, and you can object to processing based on legitimate interest. Write to [contact email]. For monitoring data that an organization put in, please contact that organization first. You can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or to the authority in your own country.

Security

Accounts use passkeys, which resist phishing. Organizations are separated in the data layer and by roles; secrets such as webhook addresses are encrypted at rest; connections use TLS. Please report vulnerabilities privately through a GitHub security advisory.

Changes

If this statement changes in a way that matters, we will say so on this page and, for account holders, by email. The date at the top shows the latest version.