Privacy Policy

1. Data Controller

For data relating to the website, accounts, billing, support and the security of the service, the data controller is GROUPE ALRIC, a SASU (single-shareholder simplified joint-stock company) with share capital of €311,000, registered under number 751 736 166 R.C.S. Paris (Paris Trade and Companies Register), located at 17 place Richard Baret, 75017 Paris, France.

Data protection contact: support@pentestlouis.com.

2. Respective Roles for Analyzed Data

When the Customer submits a repository, a domain, an application or any other scope that may contain personal data, the Customer determines the scope and purposes of the analysis. The Customer then acts as data controller, and GROUPE ALRIC processes this data on its behalf in order to provide the service, as a processor within the meaning of the GDPR.

The Customer must hold the necessary rights, authorizations and legal bases, inform data subjects where required and transmit only the data that is useful. The provisions required under Article 28 of the GDPR may be formalized upon request before any use involving personal data on the Customer’s behalf.

3. Data Processed, Purposes and Legal Bases

Account and authentication

Email address, identifier, display name, GitHub identifier, avatar, organization, language and appearance preferences, session data and the necessary sign-in history. This data is used to create and secure the account, authenticate the user and personalize the interface. Legal basis: performance of the contract and legitimate interest in protecting the service.

Repositories, domains and analyses

GitHub metadata, repository and branch names, commit identifiers, source code, domains, hosts, visible configurations, technical results, findings, evidence, reports, costs and execution events. This data is used to prepare a quote, perform the analysis, produce the results and ensure their traceability. Legal basis: performance of the contract; for data entrusted by the Customer, processing on its behalf in accordance with its documented instructions.

Payments and billing

Billing name and address, company, VAT number, amounts, currency, payment status, Stripe references, invoice and credit history. PentestLouis does not receive the full card number. Purposes: payment collection, invoicing, accounting and fraud prevention. Legal bases: performance of the contract, legal obligations and legitimate interest in preventing fraud.

Security and proof of authorization

Date and nature of actions, account and organization, requested scope, proof of authorization, IP address and user agent. Purposes: preventing unauthorized analyses, investigating incidents, defending the rights of GROUPE ALRIC and responding to legal requests. Legal basis: legitimate interest in securing a cybersecurity service and in establishing or defending legal claims.

Support and service communications

Contact details, message content, attachments and information relevant to the request, as well as analysis completion notifications. Purposes: responding, ensuring contractual follow-up and notifying the requested events. Legal bases: performance of the contract and legitimate interest in providing support. PentestLouis does not use this data to send unsolicited marketing communications.

Callback requests

The callback form collects your phone number and, if you provide them, your first name and your message in order to respond to your request. This information is sent by email via Resend to the support mailbox. It is not stored in the application’s database or in its application logs. It is handled in the same way as support messages and is not used for unsolicited marketing.

Public attestations and badges

The Customer may request the publication of an attestation showing a domain or a repository name, a date, a scope and, at its option, an amount. Viewing the page or the badge sends the visitor’s IP address and technical data to the hosting provider, without the badge setting any cookie. Legal basis: performance of the publication request and legitimate interest in serving and securing the public resource.

4. Source of the Data

• data provided directly when signing in, paying or communicating with support;
• data obtained from GitHub after authorization by the user or installation of the GitHub App;
• technical data collected during use of the website and the analyses;
• publicly accessible information about the domains, certificates, services and configurations examined;
• data returned by the technical providers called upon to perform the service.

5. Recipients and Service Providers

The data is accessible only to authorized personnel of GROUPE ALRIC and, as needed, to the following categories of service providers:

• Supabase: PostgreSQL database, authentication, storage and technical queues, with the main project in the Paris region;
• Vercel: hosting and technical logs of the website;
• Stripe: payment, automated tax calculation, invoicing and fraud prevention;
• GitHub: optional authentication and read access limited to the repositories entrusted to the GitHub App;
• Resend: sign-in links, transactional notifications and delivery of support messages and callback requests;
• Google: measuring the effectiveness of advertising campaigns and, with your consent, ad personalization (Google Ads and Google Analytics), according to the choice expressed in the consent banner;
• Hostinger: hosting, in Paris, of the server on which GROUPE ALRIC runs the open-source software OpenReplay to record browsing sessions, with your consent;
• OpenRouter and the model provider expressly named before each code analysis, for example OpenAI or Azure;
• osv.dev (public vulnerability database operated by Google): during a code analysis, receives the list of libraries used by the repository and their versions and, for folders named vendor, libs, third_party, deps, external or similar, the names of their subfolders and the paths and hashes of some of their files, never their content;
• Maven Central and PyPI (public registries of Java and Python libraries), as well as the library repositories declared in the pom.xml files of the analyzed repository or of their parents: during a code analysis, receive library names and versions in order to resolve their dependencies, never the code;
• technical services queried for diagnostics of domains, certificates, DNS, email and public exposure.

The model provider, its terms, its processing region, if any, and its retention policy are presented before each analysis concerned. No fallback to an undisclosed provider is permitted by the intended workflow. Data may also be disclosed to the authorities where required by a legal obligation.

6. Transfers Outside the European Economic Area

The main Supabase storage is configured in Paris. Some other providers are established in the United States or may use subprocessors located outside the European Economic Area. Depending on the provider and the data flow, these transfers rely on an adequacy decision, in particular the EU–U.S. framework where applicable, or on the standard contractual clauses of the European Commission, supplemented, where necessary, by additional measures.

A copy of the relevant safeguards may be requested from support@pentestlouis.com, subject to the removal of confidential information.

7. Retention Periods

• account and profile: for the life of the account, then deletion as described below;
• GitHub connection and repository metadata: until access is revoked or the account is deleted, subject to audit trails;
• working copy of the code: deleted at the end of the analysis;
• results, findings, evidence and raw analysis data: 30 days from the end of the last relevant scan;
• detailed browsing evidence, trackers and cookies observed: 7 days;
• technical cache of certain public results by domain: 7 days;
• unencrypted PDF report: 24 hours after it is generated;
• encrypted PDF report: until the account is deleted; the password is not kept by PentestLouis;
• public attestation: until it is revoked or the account is deleted;
• log of analyses and authorizations: 3 years; the full IP address is truncated after 1 year;
• browsing events in the customer area: 13 months, then deletion or anonymous aggregation;
• browsing session recordings: 30 days;
• public audience measurement: pseudonymous identifier limited to 13 months without automatic extension, and detailed events for 13 months;
• payment data and accounting records: as long as necessary for the relationship, then archiving in accordance with applicable accounting and tax obligations, for up to 10 years;
• support messages and callback requests: as long as necessary to handle the request, then archiving limited to the statute of limitations or related defense needs.

Deleting the account erases the profile, analyses, results, reports, attestations and the internal balance. The authorization log is retained for the period stated above. Records that the law requires to be kept and data held by a provider acting as a separate data controller may also remain for their own retention periods.

8. Cookies and Local Storage

PentestLouis uses the Google Ads tag, together with Google Analytics, to measure the effectiveness of its advertising campaigns, in particular credit purchases that follow a click on an ad. This tag is loaded on every page, but does not set any cookie until you have accepted the “Advertising” category in the consent banner, via “Accept all” or from “Customize”.

Without this consent, Google receives only cookieless technical signals (address of the page viewed, including any ad click parameter, timestamp, browser type, IP address transmitted by the connection), which it uses to estimate campaign results in aggregate. Legal basis: the legitimate interest of GROUPE ALRIC in measuring the effectiveness of its campaigns.

With your consent, Google may set its cookies (_gcl_* and _ga*, for 13 months after your last visit), link a conversion to the ad click that preceded it and use your visit to personalize the Google ads shown to you. Legal basis: your consent, which you may withdraw at any time; withdrawal deletes the Google cookies already set on the site.

With your consent for the “Site improvement” category, PentestLouis records your browsing with the OpenReplay software, operated by GROUPE ALRIC on its own server in Paris, to identify what hinders use of the site: addresses of the pages viewed, appearance of public pages, clicks, scrolling and mouse movements, window size, browser, operating system, device type, and country, region and city inferred from the IP address, as well as technical errors occurring in the browser. Form inputs and email addresses are masked; in the customer area, the menu and footer are recorded as is, and of the page content only the layout is recorded (buttons, placement), its text being replaced with asterisks: never the content of analyses, reports, findings or repository names. Administration pages, network requests and the browser console are not recorded. When you are signed in, the recording, including the part of the visit before you signed in, is linked to the internal identifiers of your account and your organization, never to your email address or your name. To exclude sessions of the PentestLouis team, your IP address is compared, on our server, with those of our offices: only the result accompanies the recording. The tracker stores technical identifiers (__openreplay_*) in the browser’s local storage. Legal basis: your consent; withdrawing it stops the recording and erases these identifiers.

Change my cookie choices

Internal audience measurement may be enabled in order to count page views and visitors of the PentestLouis website only, exclusively on behalf of GROUPE ALRIC. It remains separate from accounts and is used neither for targeting nor for tracking across multiple websites. The other trackers are necessary for the service or remember a choice:

• Supabase authentication cookies: establishing, maintaining and renewing the secure session;
• locale: remembering the language for one year;
• ui-theme and color-scheme: remembering the appearance for one year;
• gh_connect_state: temporarily securing the GitHub sign-in flow and remembering the chosen repository so as to return to it, then deleted upon return;
• pl_consent: remembering for 6 months your choices regarding advertising and site improvement;
• pl_audience: when enabled, pseudonymously counting unique visitors to the public website for up to 13 months, without later linking to an account.

These trackers are exempt from prior consent when they are strictly necessary for the service or requested by the user. They can be deleted from the browser settings; deleting session cookies signs out of the account and deleting preference cookies restores the default choices.

After sign-in, PentestLouis also keeps the normalized page viewed, the date and time, and certain steps of the product journey (quote, launch and completion of an analysis, credit purchase). These events are used to manage and troubleshoot the service. They contain no form input, report or security evidence, and are not cross-referenced with the public audience identifier.

9. Automated Decision-Making

Analyses, scores and vulnerability classifications are produced in whole or in part by automated tools and artificial intelligence models. They are intended to assist with security and must be verified by a competent person. PentestLouis does not make, based solely on them, any decision producing legal effects or similarly significantly affecting a person within the meaning of Article 22 of the GDPR.

10. Your Rights

Depending on the processing and its legal basis, you may request access to your data, its rectification or erasure, or restriction of processing, object to processing based on legitimate interest, request portability of the data you provided and withdraw consent for the future where processing is based on consent.

Send your request to support@pentestlouis.com or by mail to GROUPE ALRIC, 17 place Richard Baret, 75017 Paris, France. Specify the right you are exercising and the information needed to locate your account. Proof of identity will be requested only in case of reasonable doubt and only to the extent necessary. A response is provided within the period set by the GDPR, in principle one month.

You may also lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL).

11. Security

GROUPE ALRIC implements technical and organizational measures appropriate to the risk, including segregation by organization, restricted access, encryption of communications, temporary links for files, limited retention periods and encryption of reports when requested. Since no system is infallible, any suspected vulnerability should be reported, without exploiting it, to support@pentestlouis.com.

12. Changes to this Policy

This policy may change depending on the service, the service providers or the regulations. The date of the version in force appears at the top of the page. Users are informed of any substantial change by appropriate means.