This policy covers the auditbash.com website, the AuditBash Cloud Dashboard (app.auditbash.com) and the AuditBash agent. Questions or requests: support@auditbash.com.
1. The short version
- We collect what we need to run AuditBash: your account details and the security information your servers report.
- We do not sell your data, and we do not use advertising or analytics trackers.
- Passwords are stored hashed; secrets and sensitive server details are encrypted.
- You can ask for a copy of your data, or for it to be deleted, at any time.
2. What we collect
Your account
- Name, email address, company or workspace name, and the plan you chose.
- Your password, stored only as a one-way hash. If you turn on two-factor login, its secret is stored encrypted.
- Sign-in records: time, IP address and result, kept in your workspace's audit log, plus a short-lived record of failed attempts used to stop password guessing.
- Messages you send us through Support tickets or the Private Dedicated request form, including any phone number you choose to give.
Your servers (sent by the agent)
- Server name, operating system, installed language runtimes and packages, pending and installed updates, and patch history.
- Security findings: file paths and short excerpts of suspicious files, open ports, running processes, user accounts and SSH keys that changed, certificate details and website status.
- Attack information from your server's logs: attacker IP addresses, the usernames or web pages they tried, and counts.
- Results of the actions you run from the dashboard.
The agent sends only this security information. It does not upload your website files, databases or email content.
Billing
Card payments are handled by Stripe. Your card number never reaches our servers; we keep only the Stripe customer and subscription IDs, your plan, status and renewal date.
3. Why we use it
- To provide the service: show your servers' security, run the fixes and rules you choose, and send the alerts you switch on.
- To manage your account and billing, and to email you about your account, your servers, trial reminders and important changes.
- To keep AuditBash secure, prevent abuse and fix problems.
- To answer your support requests.
Where privacy laws such as the GDPR apply, we rely on performing our contract with you, on our legitimate interest in keeping the service secure, and on legal obligations (for example tax records).
4. Who helps us
We share data only with the services we need to run AuditBash, and only for that purpose:
| Service | What for | What it receives |
|---|---|---|
| Our hosting provider (GoDaddy, data centre in Phoenix, Arizona, USA) | Runs the website and Cloud Dashboard | All dashboard data, stored on our server |
| Stripe | Payments and invoices | Name, email, payment details you enter at checkout |
| SendGrid (Twilio) | Sending emails such as codes, alerts and receipts | Recipient email address and the email content |
| ipinfo.io | Showing the country, city and network of attacking IP addresses | Attacker IP addresses only |
| Google Fonts | Fonts on the auditbash.com website | Your browser's IP address when the website loads its fonts |
We may also share information if the law requires it, or to protect our customers and service from fraud or attack. If AuditBash is ever sold or merged, this policy will continue to apply to your data.
With Private Dedicated, the dashboard and its data live on your own server; we access it only when you ask us to, for setup and maintenance.
5. Where your data is stored
The Cloud Dashboard is hosted in the United States. If you are outside the US, your data is transferred there; where required we rely on appropriate safeguards for these transfers.
6. How we protect it
- All connections use HTTPS. The agent only connects out to the dashboard; it opens no ports on your server.
- Agent tokens and passwords are stored hashed. Mail and payment keys, two-factor secrets, finding details, server details and support messages are encrypted with AES-256-GCM using a key kept outside the web folder.
- Each workspace sees only its own servers and data. Access inside a workspace follows roles (admin, operator, viewer), and every sign-in, setting change and action is logged.
- Two-factor login is available to every user and can be required by workspace admins.
No system is perfectly secure, but we work to protect your data and will tell you without undue delay if a breach affects it.
7. How long we keep it
- Account and server data: while your account is open. Deleting a server in the dashboard removes its reports, findings and history.
- After you close your account, we delete your workspace data within 30 days, except invoices and payment records, which we keep as long as tax law requires.
- Backups of our database may hold deleted data for a short time until they are replaced.
8. Cookies
The dashboard uses one essential cookie to keep you signed in. It is not used for tracking and expires when you sign out or after a period of inactivity. The website sets no cookies of its own and uses no analytics or advertising trackers.
9. Your rights
You can ask us to give you a copy of your data, correct it, delete it, or stop or limit certain processing, and you can object to processing based on our legitimate interests. Email support@auditbash.com from your account's address; we reply within 30 days. You can also complain to your local data protection authority.
If you add team members or install the agent on servers that hold other people's data, you are responsible for having the right to do so, and for telling those people where your own privacy notices require it.
10. Children
AuditBash is a business tool and is not meant for anyone under 16. We do not knowingly collect children's data.
11. Changes
If we change this policy in an important way, we will email the workspace admins before the change applies. The date at the top shows the latest version.
12. Contact
Email support@auditbash.com with any privacy question or request.