How we protect your data

Account and session security

• Passwords are hashed with Argon2id. Plain text passwords are never stored.
• Session refresh tokens are stored only as hashes and delivered to the browser in HttpOnly cookies.
• Email verification, password reset and invitation links are also stored only as hashes.
• Token reuse is detected and suspicious sessions can be revoked.
• Account level mass sign-out is supported and invalidates every previously issued session.

Consent records

• In visitor consent records, the page address, referrer, browser information and IP address are stored only as hashes. Raw values are not kept.
• Each record carries an integrity value, so later modification can be detected.
• Repeated submissions of the same event are rejected, so records do not grow with duplicates.
• Banner display records are kept for 30 days and consent decision records for 395 days. Expired records are removed by a job that runs daily.

Scanning safety

• Target domains are validated before any request is made. Only addresses on the public internet are scanned.
• Attempts to redirect scans to private network addresses are blocked.
• Scan findings are stored with their evidence and cleaned up on a schedule.

Application security

• All API input passes schema validation.
• Security headers, origin restriction and parameter pollution protection are applied.
• Rate limiting is in place on authentication and other sensitive endpoints.
• Authorization is checked at workspace level on every request.
• Error responses do not expose internal details or stack traces.

Retention and deletion

• Automatic retention periods apply to audit records and consent records.
• Deleted workspaces are first held in a recoverable state, then permanently removed once the window closes.
• Every deletion is recorded.

Where your data lives

• The application server and the database are hosted in the European Union.
• The database runs in the Ireland region and the application server in the Frankfurt region.
• Your scans, policies, consent records and reports are stored on this infrastructure.
• The providers we use for payments and email may process data outside the EU. Only the data required for that specific operation is sent to them.

Services we use

Third parties we work with to deliver the service:

• Supabase, database
• Render, application server
• Vercel, website and application delivery
• Paddle, payments and billing
• Resend, transactional email

Our limits

We also write down what we do not do:

• DILAYS does not declare that you are compliant. That decision is yours and your legal advisor's.
• We do not provide independent audit services.
• Scanning does not guarantee that every technology on your site will be found. Default scan depth is limited.
• We do not offer protection against fines or enforcement action.