Data Processing

1. Roles

You (the account owner) are the controller of personal data about your sites’ visitors and users. Novatise processes it only on your instructions, to provide the service, under these terms. Need a signed data processing agreement? See our Data Processing Agreement page and write to [email protected].

2. What the plugin sends

• Site status: score, which protections are on, WordPress, PHP and plugin versions.
• Findings: file paths, sizes and SHA-256 fingerprints, and up to 300 characters of the matching code so you can see what was found (never whole files; keys and passwords in it are masked).
• Security events: sign-in attempts, lockouts, new administrators, plugin changes. IP addresses are shortened by default (the site owner can change this), usernames are sent as recorded.
• Monthly report figures.

3. What stays on your site

• Files, posts, pages, comments, orders and customer records.
• Passwords, keys and wp-config.php.
• Backups, which go straight to the storage you choose (S3, Cloudflare R2, Backblaze B2 or Wasabi).

4. Security of processing

The plugin connects out to the dashboard; the dashboard never logs in to your site. Every request is signed with a per-site secret. The dashboard can ask a site to run only the actions its owner allows in wp-admin, and every action is logged on the site and in your audit log.

5. Breaches

If we become aware of a breach affecting your data, we will tell you without undue delay and within 72 hours where possible, with what we know and what we are doing, and update you as we learn more. We notify regulators and the people affected ourselves where the law makes that our duty (see the Privacy Policy, section 14).

6. Deletion

Disconnect a site or delete your account and its data is deleted after 30 days. The account owner can download all of the account’s data as a JSON file at any time (Account › Your data).

7. Service providers (sub-processors)

We will update this list before adding a provider that handles personal data and tell account owners about the change.

• Contabo GmbH (Germany; server in Japan): hosting of the dashboard and its database.
• Resend, Inc. (United States): sending our emails (sign-in codes, alerts, reports).
• OpenRouter, Inc. (United States) and the AI model provider it routes to: the AI scan summaries, the clean-up assistant (a finding’s path and excerpt) and the chatbot test (the test questions and the chatbot’s answers).
• Have I Been Pwned (Australia): the app’s leaked-password check receives only the first 5 characters of the password’s SHA-1 fingerprint, never the password.
• Stripe, Inc. (United States, worldwide): payments and invoices.
• Cloudflare, Inc. (worldwide): this website, bot protection and email routing.
• Google LLC (United States): Safe Browsing checks of site addresses for the free scan and monitoring.
• GitHub, Inc. (United States): distribution of signed plugin releases (no personal data).