Privacy Policy

// legal

Privacy Policy

Last updated: 2026 · Operated by Scrutora Private Limited

This Privacy Policy explains how Scrutora Private Limited ("Scrutora", "we", "us") collects, uses, and protects information in connection with chAIos (the "Service"). By using the Service you agree to this Policy.

1. Information we collect

Account information — your email address, hashed password, organization, and role.
Engagement data — the targets you configure, ownership-verification and consent records, scan settings, and any authentication material you provide for authenticated scans (stored encrypted).
Findings & evidence — the vulnerabilities we detect and the request/response artifacts that prove them, captured from the targets you authorize us to test.
Usage & technical data — logs, IP address, timestamps, and diagnostic information needed to operate and secure the Service.
Cookies — a session cookie and a CSRF token cookie, strictly necessary for login and security. We do not use advertising cookies.

2. How we use information

To provide, operate, and secure the Service and run the assessments you initiate.
To generate your findings, reports, and audit/authorization records.
To maintain reliability, prevent abuse, and comply with legal obligations.
To communicate with you about your account and the Service.

We do not sell your personal information, and we do not use your engagement data or findings to target third parties.

Sensitive material. Findings and evidence can contain sensitive data from your own systems. We minimize what we store, redact detected secrets from persisted evidence where possible, and encrypt credentials and evidence at rest. You control your targets and may request deletion of your engagement data.

3. How we store & protect it

Data is stored in databases operated for the Service. We apply access controls, encryption of sensitive fields at rest, TLS in transit, and retention limits. No method of storage or transmission is 100% secure, but we work to protect your information.

4. Retention

We retain engagement data and findings for as long as your account is active or as needed to provide the Service, then delete or archive them per our retention settings, unless a longer period is required by law.

5. Sharing & disclosure

Service providers that host or support the Service, under confidentiality obligations.
Legal — when required by law, regulation, or valid legal process, or to protect rights, safety, and the integrity of the Service.
Business transfers — in connection with a merger, acquisition, or asset sale, with notice as required.

6. Your rights

Subject to applicable law, you may access, correct, export, or delete your personal information, and object to or restrict certain processing. To exercise these rights, contact us below.

7. International transfers

Your information may be processed in countries other than your own. Where required, we use appropriate safeguards for such transfers.

8. Children

The Service is not directed to individuals under 18, and we do not knowingly collect their personal information.

9. Changes

We may update this Policy; material changes will be reflected by the "Last updated" date.

10. Contact & grievances

Scrutora Private Limited — [registered office address].
Privacy / data-protection queries and grievances: privacy@scrutora.com (Grievance Officer: [name], as required under applicable Indian IT rules).

← Terms of Service