Privacy
Last updated 18 October 2026
This describes what CavScope collects, who else it passes through, and why. It is written from what the software actually does, not from a template.
This is a factual disclosure of current data practices. It does not attempt to state your rights under GDPR, UK GDPR, CCPA or any other regime. We do not offer a data processing agreement, contractual guarantees on subprocessors, or a fixed retention commitment unless a signed agreement says so.
The marketing site
This site, cavscope.28footsystems.com, has no forms, no analytics, no tag manager and no tracking pixels. It sets no cookies of its own and stores no session.
Three third parties see your IP address because your browser fetches files from them directly:
| Who | Why your browser contacts them |
|---|---|
| Google Fonts | The stylesheet and font files for the typefaces on this page. |
| jsDelivr | The Supabase JavaScript client bundle. |
| Vercel | Hosts and serves these pages. Standard server request logs. |
The page makes one call to our Supabase project to read the current published prices. It is an anonymous read of public data and it is configured not to persist a session.
The workspace
Signing in at cavscope.28footsystems.com/signin creates an account record. What we hold is your email address, your organization and role, and sign-in timestamps. Authentication is handled by Supabase Auth; your session is stored in your own browser, per origin.
We do not ask for, and the software has no field for, a date of birth, a government identifier, a physical address, or a phone number.
What a scan collects
CavScope assesses a website you tell it to assess. It requests pages the same way any anonymous visitor would, identifying itself as CavScope-Scanner/1.0, and it resolves public DNS records for the domain. It does not sign in, does not submit forms, and does not attempt to access anything a visitor could not reach.
What it stores as evidence for each finding:
- HTTP response headers and status codes
- Excerpts of the page HTML, capped in length
robots.txt, the sitemap, and/.well-known/security.txt- Public DNS answers — SPF, DMARC and MX records
If the scanned page contains personal data in its public HTML, an excerpt of that HTML may be stored as evidence. That is a consequence of quoting the page we assessed; we do not extract, index or separate personal data out of it.
Where your data goes
| Processor | What it handles |
|---|---|
| Supabase | Database, authentication, and the scan engine. Findings, evidence and account records live here. |
| Resend | Email delivery: sign-in links, invitations, password resets, and risk alerts. |
| Stripe | Payments. Card details are entered on Stripe's pages and never reach us. |
| Vercel | Hosting for the pages you are reading, and for the browser engine, which loads a scanned site's pages in a headless browser when it is switched on for an organization. |
| OpenRouter → Anthropic | Findings text is sent to a Claude model to write the plain-English narrative on a SITREP. A support message, and the screenshot if you attach one, can also be read by a Claude model to help our team respond (see below). |
Generating the narrative section of a SITREP sends the findings for that scan — rule identifiers, severities, page URLs and the evidence excerpts they cite — to a language model through OpenRouter. If that is unacceptable for a given engagement, say so and we will turn narrative generation off for your organization; every finding, score and SITREP is produced by the deterministic engine and stands without it.
The Support tab sends us your message, the page address, your browser and window size, and a screenshot of the page if you leave that box ticked. We email it to our support inbox. The screenshot is attached to that email and is not stored in our database. When AI triage is switched on, a Claude model, reached through OpenRouter, also reads the message and the screenshot and drafts notes for our team: what it seems to say, a likely cause, a suggested fix and a draft reply. The model never writes to you; a person reads everything first. A screenshot shows whatever was on your screen, so close anything private before you send one, or untick the box.
Partners and their clients
CavScope is sold through partners. When a partner uses CavScope for its clients, we handle the clients' data on the partner's instructions, and the partner is responsible for telling its clients how their data is used. We will tell partners before a new processor receives client data. We do not offer a data processing agreement unless a signed agreement says so.
Who can see what
Access is enforced in the database itself with row-level security, not only in the interface. A signed-in user sees their own organization's websites, scans, findings and SITREPs, and nothing else. 28 Foot Systems staff with super-admin rights can access a tenant's workspace for support; when they do, it is recorded in an append-only audit log that names the administrator, the target, the stated reason and the time window.
Retention
Scan history is kept so that findings can be tracked over time — that is the product. We have not yet set a fixed retention period, and rather than publish a number we do not enforce, we will say so: ask and we will delete your organization's data. When a partner leaves, its client organizations can be exported or moved for 30 days, and are then deleted.
Contact
- Privacy and data questions: support@mail.cavscope.28footsystems.com
- Security vulnerability reports: security@mail.cavscope.28footsystems.com — see our disclosure policy